OpenSEO MCP Server Authentication Methods: Local, Cloudflare Access, and OAuth 2.0

The OpenSEO MCP server supports three distinct authentication mechanisms: local no-auth admin context for trusted environments, Cloudflare Access JWT validation for self-hosted deployments, and OAuth 2.0 requiring the "mcp" scope for external integrations.

The OpenSEO MCP (Multi-Channel Platform) server, maintained in the every-app/open-seo repository, implements a tiered security model that accommodates both development convenience and production-grade access control. Understanding these OpenSEO MCP server authentication methods ensures secure deployment of MCP tools while maintaining compatibility with enterprise security policies and third-party agent integrations.

Local No-Auth Admin Context

For development environments and trusted internal networks, the server accepts requests without a bearer token when the request carries the special MCP_AUTH_CONTEXT_PROP set to the local admin context. This mechanism bypasses standard token validation entirely, allowing rapid iteration without credential management overhead.

The implementation is validated in src/server/mcp/transport.test.ts under the test case "accepts local no-auth MCP requests with the local admin context". This method should never be used in production environments exposed to external networks.

// Local no-auth admin context - development only
await fetch(`${BASE}/mcp`, {
  method: "POST",
  body: JSON.stringify({ 
    method: "tools/call",
    params: { name: "audit", arguments: { url: "example.com" } }
  }),
  // No Authorization header required
});

Cloudflare Access Authentication

Self-hosted deployments can leverage existing Cloudflare Access infrastructure to gate MCP tool usage through Cloudflare Zero Trust policies. The server validates the Cloudflare-issued JWT through the existing Access resolver, inspecting the Authorization header for the bearer token.

This integration is tested in src/server/mcp/transport.test.ts under the test case "accepts Cloudflare Access MCP requests through the existing Access resolver". The method allows organizations to enforce identity-based access without implementing custom OAuth flows.

// Cloudflare Access - pass the CF-issued JWT
await fetch(`${BASE}/mcp`, {
  method: "POST",
  headers: { 
    Authorization: `Bearer ${cloudflareJwt}` 
  },
  body: JSON.stringify({ 
    method: "tools/list" 
  }),
});

OAuth 2.0 with MCP Scope

External agents, third-party services, and the built-in OpenSEO AI agents must authenticate using OAuth 2.0 tokens obtained from the OpenSEO OAuth provider. The server enforces strict scope validation, requiring the MCP_SCOPE (defined as the string "mcp" in src/server/mcp/oauth-provider.ts) to be present in the token's scopes array.

The src/server/mcp/oauth-provider.ts file defines MCP_OAUTH_SCOPES and manages token lifetimes, while src/server/mcp/transport.ts implements the validation logic. Requests presenting valid OAuth tokens without the "mcp" scope receive a 403 MCP scope required response. The transport layer also configures CORS headers to explicitly allow the Authorization header for cross-origin OAuth flows.

// OAuth 2.0 with mandatory MCP scope
const token = await getOAuthToken({ scopes: ["mcp"] });
await fetch(`${BASE}/mcp`, {
  method: "POST",
  headers: { 
    Authorization: `Bearer ${token.access_token}` 
  },
  body: JSON.stringify({ 
    method: "tools/call",
    params: { name: "crawl", arguments: { deep: true } }
  }),
});

Authentication Validation Implementation

The src/server/mcp/transport.ts file orchestrates the complete validation pipeline. The server checks for the MCP_AUTH_CONTEXT_PROP admin context first, then attempts Cloudflare Access validation, and finally falls back to OAuth 2.0 scope verification. Each authentication pathway is mutually exclusive per request, ensuring clear security boundaries and predictable authorization behavior.

Summary

• Local admin context enables development workflows via MCP_AUTH_CONTEXT_PROP without token management, tested in src/server/mcp/transport.test.ts.
• Cloudflare Access leverages existing enterprise JWT infrastructure for self-hosted deployments.
• OAuth 2.0 requires the specific MCP_SCOPE ("mcp") defined in src/server/mcp/oauth-provider.ts, rejecting tokens without it via 403 errors.
• CORS configuration explicitly allows the Authorization header to support cross-origin OAuth flows.
• Transport layer in src/server/mcp/transport.ts coordinates validation across all three methods.

Frequently Asked Questions

What is the required OAuth scope for OpenSEO MCP server authentication?

The OpenSEO MCP server requires the MCP_SCOPE value, which is defined as the literal string "mcp" in src/server/mcp/oauth-provider.ts. The transport layer validates that the token's scopes array contains this specific value and rejects requests with a 403 MCP scope required error if the scope is absent.

Can I use the OpenSEO MCP server without authentication in production?

No. The local no-auth admin context, controlled by the MCP_AUTH_CONTEXT_PROP property, is designed exclusively for internal development environments and trusted local contexts only. Production deployments exposed to external networks must implement either Cloudflare Access or OAuth 2.0 authentication to prevent unauthorized tool access.

How does Cloudflare Access integrate with the MCP transport layer?

The server accepts Cloudflare-issued JWTs in the standard Authorization: Bearer header and validates them through the existing Access resolver infrastructure. This integration is verified in src/server/mcp/transport.test.ts and allows organizations to apply Cloudflare Zero Trust policies, including device posture checks and identity provider rules, to MCP tool access.

Where are the authentication methods implemented in the source code?

The authentication logic resides primarily in three locations: src/server/mcp/transport.ts handles request validation, CORS headers, and the sequential checks for admin context, Cloudflare Access, or OAuth scopes; src/server/mcp/oauth-provider.ts defines the MCP_OAUTH_SCOPES constant and token validation logic; and src/server/mcp/transport.test.ts contains comprehensive test suites verifying all three authentication pathways.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}