# OpenSEO MCP Server Authentication Methods: Local, Cloudflare Access, and OAuth 2.0

> Explore OpenSEO MCP server authentication: local no-auth, Cloudflare Access JWT, and OAuth 2.0. Secure your deployments with flexible options.

- Repository: [Every App/open-seo](https://github.com/every-app/open-seo)
- Tags: deep-dive
- Published: 2026-09-01

---

**The OpenSEO MCP server supports three distinct authentication mechanisms: local no-auth admin context for trusted environments, Cloudflare Access JWT validation for self-hosted deployments, and OAuth 2.0 requiring the "mcp" scope for external integrations.**

The OpenSEO MCP (Multi-Channel Platform) server, maintained in the every-app/open-seo repository, implements a tiered security model that accommodates both development convenience and production-grade access control. Understanding these OpenSEO MCP server authentication methods ensures secure deployment of MCP tools while maintaining compatibility with enterprise security policies and third-party agent integrations.

## Local No-Auth Admin Context

For development environments and trusted internal networks, the server accepts requests without a bearer token when the request carries the special `MCP_AUTH_CONTEXT_PROP` set to the local admin context. This mechanism bypasses standard token validation entirely, allowing rapid iteration without credential management overhead.

The implementation is validated in [`src/server/mcp/transport.test.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/transport.test.ts) under the test case "accepts local no-auth MCP requests with the local admin context". This method should never be used in production environments exposed to external networks.

```typescript
// Local no-auth admin context - development only
await fetch(`${BASE}/mcp`, {
  method: "POST",
  body: JSON.stringify({ 
    method: "tools/call",
    params: { name: "audit", arguments: { url: "example.com" } }
  }),
  // No Authorization header required
});

```

## Cloudflare Access Authentication

Self-hosted deployments can leverage existing Cloudflare Access infrastructure to gate MCP tool usage through Cloudflare Zero Trust policies. The server validates the Cloudflare-issued JWT through the existing Access resolver, inspecting the `Authorization` header for the bearer token.

This integration is tested in [`src/server/mcp/transport.test.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/transport.test.ts) under the test case "accepts Cloudflare Access MCP requests through the existing Access resolver". The method allows organizations to enforce identity-based access without implementing custom OAuth flows.

```typescript
// Cloudflare Access - pass the CF-issued JWT
await fetch(`${BASE}/mcp`, {
  method: "POST",
  headers: { 
    Authorization: `Bearer ${cloudflareJwt}` 
  },
  body: JSON.stringify({ 
    method: "tools/list" 
  }),
});

```

## OAuth 2.0 with MCP Scope

External agents, third-party services, and the built-in OpenSEO AI agents must authenticate using OAuth 2.0 tokens obtained from the OpenSEO OAuth provider. The server enforces strict scope validation, requiring the `MCP_SCOPE` (defined as the string `"mcp"` in [`src/server/mcp/oauth-provider.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/oauth-provider.ts)) to be present in the token's scopes array.

The [`src/server/mcp/oauth-provider.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/oauth-provider.ts) file defines `MCP_OAUTH_SCOPES` and manages token lifetimes, while [`src/server/mcp/transport.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/transport.ts) implements the validation logic. Requests presenting valid OAuth tokens without the "mcp" scope receive a `403 MCP scope required` response. The transport layer also configures CORS headers to explicitly allow the `Authorization` header for cross-origin OAuth flows.

```typescript
// OAuth 2.0 with mandatory MCP scope
const token = await getOAuthToken({ scopes: ["mcp"] });
await fetch(`${BASE}/mcp`, {
  method: "POST",
  headers: { 
    Authorization: `Bearer ${token.access_token}` 
  },
  body: JSON.stringify({ 
    method: "tools/call",
    params: { name: "crawl", arguments: { deep: true } }
  }),
});

```

## Authentication Validation Implementation

The [`src/server/mcp/transport.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/transport.ts) file orchestrates the complete validation pipeline. The server checks for the `MCP_AUTH_CONTEXT_PROP` admin context first, then attempts Cloudflare Access validation, and finally falls back to OAuth 2.0 scope verification. Each authentication pathway is mutually exclusive per request, ensuring clear security boundaries and predictable authorization behavior.

## Summary

- **Local admin context** enables development workflows via `MCP_AUTH_CONTEXT_PROP` without token management, tested in [`src/server/mcp/transport.test.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/transport.test.ts).
- **Cloudflare Access** leverages existing enterprise JWT infrastructure for self-hosted deployments.
- **OAuth 2.0** requires the specific `MCP_SCOPE` ("mcp") defined in [`src/server/mcp/oauth-provider.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/oauth-provider.ts), rejecting tokens without it via 403 errors.
- **CORS configuration** explicitly allows the `Authorization` header to support cross-origin OAuth flows.
- **Transport layer** in [`src/server/mcp/transport.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/transport.ts) coordinates validation across all three methods.

## Frequently Asked Questions

### What is the required OAuth scope for OpenSEO MCP server authentication?

The OpenSEO MCP server requires the `MCP_SCOPE` value, which is defined as the literal string `"mcp"` in [`src/server/mcp/oauth-provider.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/oauth-provider.ts). The transport layer validates that the token's `scopes` array contains this specific value and rejects requests with a `403 MCP scope required` error if the scope is absent.

### Can I use the OpenSEO MCP server without authentication in production?

No. The local no-auth admin context, controlled by the `MCP_AUTH_CONTEXT_PROP` property, is designed exclusively for internal development environments and trusted local contexts only. Production deployments exposed to external networks must implement either Cloudflare Access or OAuth 2.0 authentication to prevent unauthorized tool access.

### How does Cloudflare Access integrate with the MCP transport layer?

The server accepts Cloudflare-issued JWTs in the standard `Authorization: Bearer` header and validates them through the existing Access resolver infrastructure. This integration is verified in [`src/server/mcp/transport.test.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/transport.test.ts) and allows organizations to apply Cloudflare Zero Trust policies, including device posture checks and identity provider rules, to MCP tool access.

### Where are the authentication methods implemented in the source code?

The authentication logic resides primarily in three locations: [`src/server/mcp/transport.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/transport.ts) handles request validation, CORS headers, and the sequential checks for admin context, Cloudflare Access, or OAuth scopes; [`src/server/mcp/oauth-provider.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/oauth-provider.ts) defines the `MCP_OAUTH_SCOPES` constant and token validation logic; and [`src/server/mcp/transport.test.ts`](https://github.com/every-app/open-seo/blob/main/src/server/mcp/transport.test.ts) contains comprehensive test suites verifying all three authentication pathways.