MCP + OAuth2.1 + AWS Cognito Example MCP Server

MCP Server Authorization Example with AWS Cognito

Remote serverstreamable-http

What is the MCP + OAuth2.1 + AWS Cognito Example MCP Server?

MCP Server Authorization Example with AWS Cognito

What you get

This repository demonstrates how to secure a Model Context Protocol (MCP) server using OAuth 2.1 authorization flows, implemented entirely with Node.js and Express.js. While this example uses AWS Cognito as the backing authorization server, the implementation is provider-agnostic and can work with any OAuth 2.1 compliant authorization server.

Configuration and credentials

  • Node.js 18+ installed - AWS test account with access to: - Cognito for Authorization Server (1 user pool, 2 app clients) - API Gateway / Lambda / DynamoDB for DCR and CIMD bridge (2 resources, 2 functions, 1 table) - CloudFormation for deploy (1 stack) - Basic knowledge of OAuth 2.1 flows

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Configuration

  • Node.js 18+ installed - AWS test account with access to: - Cognito for Authorization Server (1 user pool, 2 app clients) - API Gateway / Lambda / DynamoDB for DCR and CIMD bridge (2 resources, 2 functions, 1 table) - CloudFormation for deploy (1 stack) - Basic knowledge of OAuth 2.1 flows
VariableDescriptionRequired
CLIENT_SECRETCredential the server authenticates with.Yes

Example prompts to try

  • “Use MCP + OAuth2.1 + AWS Cognito Example to Provider.”
  • “Use MCP + OAuth2.1 + AWS Cognito Example to Auto.”
  • “Use MCP + OAuth2.1 + AWS Cognito Example to Clients.”

Frequently asked questions

Dynamic Client Registration (DCR) lets clients register with the authorization server at runtime via an API endpoint. Client ID Metadata Documents (CIMD) allow a client to use an HTTPS URL as its `client_id`; the authorization server fetches the metadata document from that URL, avoiding pre‑registration entirely.