Secure Your MCP Servers with OAuth, JWT, SPIFFE and More
summary
A working MCP setup shows OAuth2 via Keycloak, JWT claims checked for issuer/audience, and SPIFFE mTLS handled at the gateway so no server code changes are needed; an Agent Gateway fronts multiple MCP servers (including the GitHub MCP server) to add rate limiting, request tracing, and per-role authorization (admin sees echo, user only sees get-time). Live demos run locally and in Kubernetes, with tokens decoded and policy-based multiplexing proving the pattern.
AI-written summary · about
chapters (10)
- 0:00MCP server challenges
- 1:08OAuth and JWT for MCP
- 3:41OAuth flow for AI agents
- 4:52Live demo OAuth MCP
- 10:14MCP gateway OAuth setup
- 14:09JWT validation gateway
- 15:37Role-based access JWT
- 18:29Kubernetes SPIFFE MCP
- 23:52Key takeaways MCP gateway
- 25:22Q&A
related talks
25mSecure Your MCP Servers With OAuth, JWT, SPIFFE and More
45mSecuring MCP Servers with Spring AI
25mOAuth Gets You In, Zero Trust Keeps You Safe
26mWho Let the Agent In? Securing MCP Servers in Production
11mLightning Talk: Effortlessly Integrating Keycloak Authentication To Your MCP Servers
32mAI Agents with Keycloak in MCP
31mThe MCP Gateway: A Journey from Idea to Infrastructure
23mOne Login to Rule Them All: Cross-App Access for MCP