Build an Auth0-protected MCP server
Build an Auth0-Protected Minimal MCP Server
You are tasked with developing a local HTTP service that functions as a minimal Model Context Protocol (MCP) server. This server will expose a single tool, whoami, and must be secured using JWT access tokens issued by Auth0.
Requirements
1. JWT Authentication Middleware
Implement a middleware component responsible for validating incoming requests. This validation must occur by inspecting a Bearer token found in the Authorization header.
The JWT validation process must adhere to the following criteria:
- Signature Algorithm: The token's signature must use the RS256 algorithm.
- Signature Verification: The signature must be verified using Auth0’s public keys, typically obtained from a JSON Web Key Set (JWKS) endpoint.
- Claims Validation:
- The
iss(issuer) claim must precisely match the configured Auth0 issuer. - The
aud(audience) claim must precisely match the configured API audience. - The
iat(issued at) andexp(expiration) claims must be validated to ensure the token is not expired and was issued at a reasonable time.
- The
- Client Identity: The token must contain either an
azp(authorized party) claim or aclient_idclaim to identify the client application.
2. Tool Authorization (Scope Check)
The whoami MCP tool must only be accessible if the validated JWT contains the specific scope tool:whoami.
- Scope Location: Assume scopes are provided within the token as a space-delimited
scopeclaim. Support for apermissionsclaim, if present, is also acceptable.
3. Error Handling
The server must return standard HTTP error responses for authentication and authorization failures:
- 401 Unauthorized: For requests with missing or invalid tokens. This includes issues like a bad signature, incorrect issuer or audience, or an expired token.
- 403 Forbidden: For requests with a valid token that explicitly lacks the necessary
tool:whoamipermission/scope to access thewhoamitool.
4. whoami Tool Behavior
Upon successful authorization, the whoami tool should respond with basic identity information. This information must be extracted directly from the validated JWT, including details such as the subject/user ID, client ID, issuer, audience, and granted scopes.
Deliverable
A fully functional, locally runnable HTTP server. The server must start successfully and allow calls using a real Auth0 access token. Crucially, the whoami tool must be effectively protected by both the JWT authentication middleware and the tool:whoami scope check.
AI interview prep
Core dilemma
Implementing robust and secure authentication and authorization in a microservice using an external identity provider (Auth0), balancing security best practices with practical, performant, and maintainable code.
3 tradeoffs and 3 stress tests locked
Interview prep
Unlock the interviewer X-Ray rubric, tradeoff matrix, stress tests, clarifying questions, and key concepts.
Build an Auth0-protected MCP server
Build an Auth0-Protected Minimal MCP Server
You are tasked with developing a local HTTP service that functions as a minimal Model Context Protocol (MCP) server. This server will expose a single tool, whoami, and must be secured using JWT access tokens issued by Auth0.
Requirements
1. JWT Authentication Middleware
Implement a middleware component responsible for validating incoming requests. This validation must occur by inspecting a Bearer token found in the Authorization header.
The JWT validation process must adhere to the following criteria:
- Signature Algorithm: The token's signature must use the RS256 algorithm.
- Signature Verification: The signature must be verified using Auth0’s public keys, typically obtained from a JSON Web Key Set (JWKS) endpoint.
- Claims Validation:
- The
iss(issuer) claim must precisely match the configured Auth0 issuer. - The
aud(audience) claim must precisely match the configured API audience. - The
iat(issued at) andexp(expiration) claims must be validated to ensure the token is not expired and was issued at a reasonable time.
- The
- Client Identity: The token must contain either an
azp(authorized party) claim or aclient_idclaim to identify the client application.
2. Tool Authorization (Scope Check)
The whoami MCP tool must only be accessible if the validated JWT contains the specific scope tool:whoami.
- Scope Location: Assume scopes are provided within the token as a space-delimited
scopeclaim. Support for apermissionsclaim, if present, is also acceptable.
3. Error Handling
The server must return standard HTTP error responses for authentication and authorization failures:
- 401 Unauthorized: For requests with missing or invalid tokens. This includes issues like a bad signature, incorrect issuer or audience, or an expired token.
- 403 Forbidden: For requests with a valid token that explicitly lacks the necessary
tool:whoamipermission/scope to access thewhoamitool.
4. whoami Tool Behavior
Upon successful authorization, the whoami tool should respond with basic identity information. This information must be extracted directly from the validated JWT, including details such as the subject/user ID, client ID, issuer, audience, and granted scopes.
Deliverable
A fully functional, locally runnable HTTP server. The server must start successfully and allow calls using a real Auth0 access token. Crucially, the whoami tool must be effectively protected by both the JWT authentication middleware and the tool:whoami scope check.