Remote MCP Server with Auth
https://github.com/coleam00/remote-mcp-server-with-auth- Category
- Developer Tools
- Rank
- No. 958Tools index
Previous survey · No. 947 ·
- Pricing
- Open Source
- Type
- TOOL
- Builder
- coleam00
- GitHub
- 299 stars
- Date
About
Production-ready starter template for a remote MCP server with GitHub OAuth — best-practice scaffolding for any MCP build.
What it does
This TypeScript project exposes a PostgreSQL database to authenticated MCP clients through Cloudflare Workers. GitHub handles identity. Authenticated users can inspect the public schema and run reads, while an allowlist controls access to writes and schema changes. Clients connect through streamable HTTP or legacy server-sent events.
Why it's ranked here
The project combines a working OAuth flow, PostgreSQL access, dual MCP transports, permission-aware tool registration, and optional Sentry tracing. Its concrete database example makes the architecture easier to understand. However, the SQL safety model relies on pattern checks around raw SQL, so production adopters still need substantial security hardening.
What's good
Read and write capabilities are separated by GitHub identity, and unauthorized users never receive the write tool. Schema discovery groups public tables with column metadata. Database connections use a small shared pool with shutdown cleanup. Signed approval cookies reduce repeated consent prompts, while optional tracing records user and tool context.
Tradeoffs
The read tool accepts raw SQL and blocks writes by checking leading keywords, while broader validation uses regular expressions. The source itself advises parameterized queries for production. Write access is a hardcoded GitHub username set that requires editing and redeployment. The implementation targets PostgreSQL, Cloudflare Workers, GitHub OAuth, and the public schema rather than offering portable adapters.
How to use it well
Use it as a starting point for a small team exposing controlled PostgreSQL exploration to MCP clients on Cloudflare. Begin with schema discovery, keep ordinary users read-only, and restrict write access tightly. Replace raw SQL handling with parameterized or structured operations before sensitive deployment. It does not provide a general database abstraction, an authorization dashboard, or database provisioning.
Technical notes+
src/index.ts wraps MyMCP in Cloudflare's OAuthProvider, mapping /mcp and /sse while delegating OAuth pages to src/auth/github-handler.ts. That handler exchanges GitHub credentials through Octokit and stores identity plus the upstream access token in MCP props. src/tools/register-tools.ts delegates to src/tools/database-tools.ts, where ALLOWED_USERNAMES controls whether executeDatabase is registered. Queries run through db.unsafe and the singleton pool in src/database/connection.ts; src/database/security.ts applies keyword and regex checks rather than parameterization. src/index_sentry.ts and src/tools/database-tools-sentry.ts provide an instrumented alternative. src/simple-math.ts is a smaller dual-transport example. package.json supplies Wrangler, TypeScript, and Vitest scripts, while vitest.config.js selects a Node test environment.
Observed
- Primary language
- TypeScript, with a JavaScript Vitest configuration
- Package surface
- Private npm package using ES modules
- Interface
- Remote MCP server over streamable HTTP and legacy server-sent events
- Runtime platform
- Cloudflare Workers with Durable Objects and KV-backed OAuth infrastructure
- Authentication
- GitHub OAuth through Cloudflare's Workers OAuth provider
- Database support
- PostgreSQL through the postgres package
- Developer commands
- npm scripts cover local Wrangler development, deployment, type checking, and Vitest
Read from README.md, package.json, src/index.ts, src/types.ts, src/simple-math.ts, src/index_sentry.ts, src/database/utils.ts, src/auth/oauth-utils.ts, src/database/security.ts, src/auth/github-handler.ts, src/database/connection.ts, src/tools/database-tools.ts, src/tools/register-tools.ts, src/tools/database-tools-sentry.ts, vitest.config.js.
What it can do
Authenticate users via GitHub OAuth
GitHub credentials → Authenticated user session
Scaffold MCP server project structure
Project configuration parameters → Complete MCP server codebase with best practices
Handle remote MCP protocol connections
MCP client requests → MCP protocol responses
Manage user authorization and access control
User permissions and resource requests → Authorization decisions and access tokens
Provide production-ready server template
Development requirements → Deployable MCP server configuration
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.