Implementing OAuth 2.0 Authentication for MCP Endpoint in ASP.NET Core

[Gopichandar]

Pre-submission Checklist

• I have checked that this question would not be more appropriate as an issue in a specific repository
• I have searched existing discussions and documentation for answers

Question Category

• Protocol Specification
• SDK Usage
• Server Implementation
• General Implementation
• Documentation
• Other

Your Question

ello everyone,

I'm working on an ASP.NET Core application where I need to secure the MCP (Model Context Protocol) endpoint using OAuth 2.0 authentication. Currently, the application uses cookie-based authentication for user login, but I want to transition to OAuth 2.0 to enhance security and allow integration with external identity providers.

Here's the current setup for cookie-based authentication:

csharp

builder.Services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
    .AddCookie(options =>
    {
        options.LoginPath = "/login";
        options.LogoutPath = "/logout";
        options.AccessDeniedPath = "/login";
        options.ExpireTimeSpan = TimeSpan.FromHours(24);
        options.SlidingExpiration = true;
    });

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("McpAccess", policy =>
        policy.RequireAuthenticatedUser());
});

And the MCP endpoint is configured as follows:

csharp

app.MapMcp().RequireAuthorization("McpAccess");

I want to replace the cookie-based authentication with OAuth 2.0, possibly using JWT bearer tokens, to secure the /sse endpoint provided by MapMcp(). I'm looking for guidance on:

Configuring the ASP.NET Core application to use OAuth 2.0 authentication.

Protecting the MCP endpoint with OAuth 2.0.

Handling token validation and authorization policies.

Any best practices or considerations when implementing OAuth 2.0 in this context.

Has anyone implemented OAuth 2.0 authentication for an MCP endpoint in ASP.NET Core? Any code examples, tutorials, or references would be greatly appreciated.

Thank you in advance for your help!