MCP Servers & AI Agents
How to Integrate Authentication into Your MCP Server / SDK Agent?
Use the runtime SDK for new MCP servers. It mounts protected-resource metadata, validates bearer tokens, publishes your tool manifest, and enforces AuthSec's tool policy before your handler runs.
- Python
- TypeScript
Step 1: Install AuthSec SDK
pip install authsec-sdk
Step 2: Mount your existing MCP handler
from fastapi import FastAPI
from authsec_sdk import from_env, mount_mcp
app = FastAPI()
cfg = from_env()
mount_mcp(app, "/mcp", existing_mcp_handler, cfg)
Step 3: Run Your Server
python server.py
Step 1: Install AuthSec SDK
npm install @authsec/sdk express
Step 2: Mount your existing MCP handler
import express from "express";
import { loadConfigFromEnv, mountMCP } from "@authsec/sdk";
const app = express();
app.use(express.json());
await mountMCP(app, {
config: loadConfigFromEnv(),
path: "/mcp",
tools: [{ name: "hello", description: "Say hello", suggested_scopes: ["demo:read"] }],
});
app.post("/mcp", existingMcpHandler);
app.listen(8080);
How Do You Do Autonomous Agent (Machine to Machine) Authorization?
A machine (pipeline, service, workload) proves its identity to AuthSec with
one of three credential types, all usable through the same
AgentIdentity class in the Python SDK:
| Method | Proof | Best for |
|---|---|---|
| Client secret | shared secret (HTTP Basic) | simple deployments |
| Private-key JWT | RS256-signed assertion (RFC 7523) | enterprise postures, no shared secret |
| SPIFFE SVID | platform-attested workload identity | Kubernetes — no stored credential |
Complete walkthrough (dashboard setup, code, troubleshooting): M2M auth — three methods.
For the SPIRE agent infrastructure itself (Kubernetes / Docker / VM deployment), see Deploy the SPIRE agent.