How can we add Authentication And Authorization in MCP?

[taimurlak]

Pre-submission Checklist

• I have checked that this question would not be more appropriate as an issue in a specific repository
• I have searched existing discussions and documentation for answers

Question Category

• Protocol Specification
• SDK Usage
• Server Implementation
• General Implementation
• Documentation
• Other

Your Question

How can we add Authentication And Authorization in MCP, just like we add in our API, this make our api authorize and give us the identity of user, how can we do same thing with MCP in dotnet

[alefcarlos]

I tried the default Authentication boilerplate:

Program.cs

var builder = WebApplication.CreateBuilder(args);
builder.Services.AddSingleton<MonkeyService>();
builder.Services.AddSingleton<VoyagesService>();

builder.Services.AddAuthorization();
builder.Services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme)
                .AddJwtBearer();

builder.Services
    .AddMcpServer()
    //.WithStdioServerTransport()
    .WithToolsFromAssembly();

var app = builder.Build();

app.UseAuthentication();
app.UseAuthorization();

app.MapMcp();

await app.RunAsync();

Tool.cs

    [McpServerTool, Description("It prints Hello World!")]
    [Authorize]
    public static string HelloWorld() => "Hello World!";

but it doesnt work, I think the authentication framework is not yet supported

[taimurlak]

Yes maybe, i am also waiting to find a good solution for authentication and authorizations.

[coronabytes]

While custom bearer auth works. I cant find a way to access the ClaimsPrincipal or even just the userId inside the tool call

Update: Got it, however pls support this natively, maybe by accrpting ClaimsPrincial as param?

[McpServerToolType]
public static class EchoTool
{
    [McpServerTool(ReadOnly = true), Description("Echoes the message back to the client.")]
    public static async Task<string> Echo(IHttpContextAccessor accessor, string message)
    {
        var userId = accessor.HttpContext?.User.Claims.SingleOrDefault(x => x.Type == ClaimTypes.NameIdentifier)?.Value;

        return $"hello {message}";
    }
}

[jason-lee-x]

I think RunSessionHandler may works

.WithHttpTransport(options =>
{
    options.RunSessionHandler = async (context, server, cancellationToken) =>
    {
        if (context.Request.Headers.TryGetValue("Authorization", out var token))
        {
            // TODO: atuh token

            // run
            await server.RunAsync(cancellationToken);
        }
    };
})