Secure an MCP Server with OAuth

service:
  name: contacts-mcp
env:
  - name: HTTP_PORT
    default: "8080"
  - name: SUPABASE_DSN
    required: true
  - name: OIDC_ISSUER
    default: https://auth.example.com
  - name: MCP_RESOURCE_URL
    default: https://contacts.example.com/mcp
  - name: RESOURCE_METADATA_URL
    default: https://contacts.example.com/.well-known/oauth-protected-resource/mcp
resources:
  templates:
    - resource: prompts/add_contact.md
      as: add_contact_prompt
    - resource: prompts/find_contact.md
      as: find_contact_prompt
    - resource: prompts/update_contact_info.md
      as: update_contact_prompt
    - resource: prompts/directory_overview.md
      as: directory_overview_prompt
    - resource: templates/protected-resource-metadata.json
      as: protected_resource_metadata
connectors:
  - name: api
    type: http
    settings:
      port: ${HTTP_PORT}
  - name: db
    type: database
    settings:
      driver: postgres
      dsn: ${SUPABASE_DSN}
      maxOpenConns: 5
      connMaxLifetime: 5m
flows:
  - name: mcp
    source:
      connector: api
      type: http
      settings:
        path: /mcp
        headers:
          - Authorization
        responseHeaders:
          - WWW-Authenticate
    process:
      - type: jwt-validate
        settings:
          mode: discover
          tokenHeader: Authorization
          claimsVar: jwt
          disableWwwAuthenticate: false
          issuer: ${OIDC_ISSUER}
          resourceMetadataUrl: ${RESOURCE_METADATA_URL}
      - type: mcp-router
        name: contacts-router
        serverName: contacts
        tools:
          # ... five SQL-backed tools, shown below
        prompts:
          # ... four prompts, shown below

WWW-Authenticate: Bearer realm="https://auth.example.com", resource_metadata="https://contacts.example.com/.well-known/oauth-protected-resource/mcp"

  - name: protected-resource-metadata
    source:
      connector: api
      type: http
      settings:
        path: /.well-known/oauth-protected-resource/mcp
    process:
      - type: template-resource
        name: render-metadata
        settings:
          id: protected_resource_metadata
          rawBody: true
          contentType: application/json

{
  "resource": "{{ env.MCP_RESOURCE_URL }}",
  "authorization_servers": ["{{ env.OIDC_ISSUER }}"],
  "bearer_methods_supported": ["header"]
}

tools:
  - name: create_contact
    description: Create a new contact. first_name is required; all other fields are
      optional. Returns the created contact including its generated id.
    inputSchema: |
      {
        "type": "object",
        "required": ["first_name"],
        "properties": {
          "first_name": { "type": "string" },
          "last_name":  { "type": "string" },
          "email":      { "type": "string" },
          "phone":      { "type": "string" },
          "company":    { "type": "string" },
          "notes":      { "type": "string" }
        }
      }
    process:
      - type: sql
        name: insert-contact
        settings:
          connector: db
          single: true
          query: >
            insert into contacts (first_name, last_name, email, phone,
            company, notes)

            values ($1, $2, $3, $4, $5, $6)

            returning *
          args:
            - body.first_name
            - "has(body.last_name) ? body.last_name : null"
            - "has(body.email) ? body.email : null"
            - "has(body.phone) ? body.phone : null"
            - "has(body.company) ? body.company : null"
            - "has(body.notes) ? body.notes : null"

I'd like to add a new contact to the contacts database.

Here are the details I have:

{{ body.details }}

Please pull out the person's first name, last name, email, phone, company, and
any notes from that description, then call the `create_contact` tool to save
them. First name is required; if you can't find one, ask me before saving.
When it's done, show me the created contact (including its new id) and confirm
what you stored.