Where mcp-login-oauth is going¶
What is planned and what has shipped, from four copies of the same OAuth code to one library for FastMCP servers. Each step serves a value and has its issue or pull request.
Accept clients that identify themselves by a metadata URL, which the MCP spec now prefers over dynamic registration.
Details
Fetch and validate the document (HTTPS only, size and time limits), take its redirect_uris, cache it within limits, and advertise support in the metadata. Dynamic registration stays.
Getting started, reference, behaviour, values and this roadmap, with diagrams and a design of its own.
The login OAuth of four FastMCP servers in one library, with an encrypted store and revocation for public clients.
The idea behind all of it¶
One small, strict OAuth server for MCP clients of FastMCP servers, that holds nothing usable at rest and leaves the login itself to the server.
Parked¶
Nothing yet.
Decided against¶
Nothing yet.
Keep it true¶
The timeline is rendered from docs/roadmap.yml; on GitHub, read that file. Finish a step in the pull request that finishes it: set status: done, replace when with a date, add the link to its pull request, and move it to the top of the shipped entries. Change the file in the pull request that changes the plan.