MCP -with-HTTPS-and-GitHub-OAuth

This MCP server is a secure local instance built with Node.js and Express. It serves over HTTPS using a self-signed certificate and integrates GitHub OAuth for user authentication, along with security measures like rate limiting and helmet-based HTTP header protections. After starting the server, you can access the site securely at https://localhost:3000. Use the /auth route to begin GitHub authentication, which will redirect you through GitHub and back to the app at /success on successful login. A protected route such as /secure-data requires authentication; unauthenticated requests to that route will yield a 401 error. The server is designed to enforce secure sessions and handle common web security concerns, making it suitable for local development and testing of OAuth-protected MCP endpoints.

Prerequisites:

• Node.js v16 or later
• npm (comes with Node.js)
• OpenSSL (for generating SSL certificates)

Step-by-step installation:

1. Clone the repository git clone https://github.com/omar-steam/MCP-Server-with-HTTPS-and-GitHub-OAuth.git cd mcp-server

2. Install dependencies npm install

3. Generate SSL certificates for HTTPS (self-signed for local use) openssl genrsa -out key.pem 2048 openssl req -new -key key.pem -out csr.pem openssl x509 -req -days 365 -in csr.pem -signkey key.pem -out cert.pem // This will produce key.pem and cert.pem in the project root

4. Configure environment variables Create a .env file in the project root with the following: CLIENT_ID=your-github-client-id CLIENT_SECRET=your-github-client-secret REDIRECT_URI=https://localhost:3000/auth/callback SESSION_SECRET=your-session-secret // Replace the placeholders with your actual GitHub OAuth app credentials

5. Start the server node server.js // You should see something like: Secure server running on https://localhost:3000

Tips and notes:

• The server uses self-signed certificates for HTTPS. Browsers will show security warnings; you can proceed for development purposes. For production, replace with a certificate from a trusted CA.
• Ensure the .env values (CLIENT_ID, CLIENT_SECRET, REDIRECT_URI, SESSION_SECRET) are correctly set; mismatches can cause OAuth failures.
• If port 3000 is in use, update the server code to listen on a different port or stop the conflicting service.
• The authentication flow relies on GitHub OAuth app settings; make sure the OAuth app includes the correct Redirect URL (https://localhost:3000/auth/callback).
• For production-like testing, consider adjusting rate limiting and helmet configurations as needed for your environment.