MCP OAuth and OpenID Connect

Implement a secure MCP server using OAuth DPoP and Duende identity provider

Setup

The UI application uses OpenID Connect to authentication with Duende identity provider. A DPoP access token is returned which is used to access the model context protocol server.

Blogs:

• Implement a secure MCP server using OAuth and Entra ID
• Implement a secure MCP OAuth desktop client using OAuth and Entra ID
• Model Context Protocol in .NET
• Developing an MCP Scenario with TypeScript: A production-ready reference implementation, Tobias Maestrini
• Implement a secure MCP server using OAuth DPoP and Duende identity provider

History

• 2026-02-03 Updated packages
• 2026-01-31 Updated packages
• 2025-12-01 .NET 10
• 2025-11-02 Updated packages

Links

https://github.com/damienbod/McpSecurity

https://learn.microsoft.com/en-us/agent-framework/migration-guide/from-semantic-kernel/?pivots=programming-language-csharp

https://devblogs.microsoft.com/dotnet/mcp-server-dotnet-nuget-quickstart/

https://github.com/microsoft/mcp-dotnet-samples

https://learn.microsoft.com/en-us/dotnet/ai/quickstarts/build-mcp-server

Standards, draft Standards

OAuth 2.0 Dynamic Client Registration Protocol

OAuth 2.0 Authorization Server Metadata

https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization

https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices

modelcontextprotocol/modelcontextprotocol#1299

https://den.dev/blog/mcp-authorization-resource/

AI UI agents with OAuth support

https://github.com/daodao97/chatmcp

https://claude.ai/download

https://cursor.com/

Visual Studio code

Visual Studio

Links

https://github.com/MicrosoftDocs/mcp

https://devblogs.microsoft.com/dotnet/mcp-csharp-sdk-2025-06-18-update/

https://modelcontextprotocol.io/docs/learn/architecture

https://github.com/SonarSource/sonarqube-mcp-server

https://den.dev/blog/mcp-authorization-resource/

https://den.dev/blog/mcp-csharp-sdk-authorization/

modelcontextprotocol/modelcontextprotocol#1299

https://blog.cloudflare.com/building-ai-agents-with-mcp-authn-authz-and-durable-objects/

https://blog.aidanjohn.org/2025/07/30/mcp-a-new-frontier-in.html

https://medium.com/kagenti-the-agentic-platform/security-in-and-around-mcp-part-1-oauth-in-mcp-3f15fed0dd6e

https://medium.com/kagenti-the-agentic-platform/security-in-and-around-mcp-part-2-mcp-in-deployment-65bdd0ba9dc6

https://blog.christianposta.com/implementing-mcp-dynamic-client-registration-with-spiffe/

https://blog.christianposta.com/authenticating-mcp-oauth-clients-with-spiffe/

https://luke.geek.nz/azure/akahu-mcp-apim/

https://github.com/modelcontextprotocol/inspector

Copilot Links

dotnet/AspNetCore.Docs#35798

https://docs.github.com/en/copilot/how-tos/custom-instructions/adding-repository-custom-instructions-for-github-copilot

https://github.com/dotnet/docs-aspire/blob/main/.github/copilot-instructions.md

Azure OpenAI

https://learn.microsoft.com/en-us/azure/ai-foundry/

Ready to use servers

https://mcpservers.org/

https://devblogs.microsoft.com/azure-sdk/introducing-the-azure-mcp-server/

Learning Courses

https://github.com/microsoft/mcp-for-beginners

Azure App Service MCP server

https://github.com/Azure-Samples/remote-mcp-webapp-dotnet

Testing MCP Client tool

npx @modelcontextprotocol/inspector

https://github.com/modelcontextprotocol/csharp-sdk/blob/main/samples/ProtectedMcpClient/Program.cs

https://github.com/Azure-Samples/ms-identity-dotnet-desktop-tutorial/blob/master/1-Calling-MSGraph/1-1-AzureAD/Console-Interactive-MultiTarget/Program.cs