Indian Store MCP Server with Ory Hydra OAuth

A production-ready Model Context Protocol (MCP) server with external OAuth 2.0 authentication powered by Ory Hydra. This implementation separates authentication concerns: your MCP server handles user authentication, while Ory Hydra handles OAuth token management.

📖 Table of Contents

• Architecture Overview
• What We Implemented
• How It Works
• Directory Structure
• Components Deep Dive
• Security Model
• Installation
• User Management
• Testing
• Troubleshooting

🏗️ Architecture Overview

High-Level Architecture

┌──────────────────────────────────────────────────────────────────┐
│                      MCP CLIENTS                                 │
│              (ChatGPT, Claude, Desktop Apps)                     │
└───────────────────────────┬──────────────────────────────────────┘
                            │
                            │ HTTPS
                            ▼
┌──────────────────────────────────────────────────────────────────┐
│                    GATEWAY API (Kubernetes)                      │
│  Routes:                                                         │
│  • /.well-known/* → MCP Server (OAuth Discovery)               │
│  • /oauth2/* → Ory Hydra (OAuth Endpoints)                     │
│  • /oauth/register → MCP Server (Client Registration)          │
│  • /login, /consent → MCP Server (Auth Handlers)               │
│  • /mcp → MCP Server (Protected API)                           │
└────────────────┬────────────────┬────────────────────────────────┘
                 │                │
                 │                │
     ┌───────────▼───────┐    ┌──▼─────────────────────────┐
     │   MCP SERVER      │    │    ORY HYDRA               │
     │   (Port 8080)     │◄───┤    (OAuth Provider)        │
     │                   │    │    Public: 4444            │
     │ Responsibilities: │    │    Admin: 4445             │
     │ • User Auth       │    │                            │
     │ • Login UI        │    │  Responsibilities:         │
     │ • Consent         │    │  • OAuth Protocol          │
     │ • Client Reg      │    │  • Token Issuance          │
     │ • MCP Protocol    │    │  • Token Validation        │
     │ • Token Validate  │    │  • Client Storage          │
     └──────┬────────────┘    └───────┬────────────────────┘
            │                         │
            │                         │
            ▼                         ▼
     ┌────────────────────────────────────────┐
     │         PostgreSQL Database            │
     │  • users (MCP Server)                  │
     │  • hydra_* tables (Ory Hydra)          │
     │    - clients                           │
     │    - access_tokens                     │
     │    - refresh_tokens                    │
     │    - authorization_codes               │
     └────────────────────────────────────────┘

Key Principle

YOUR MCP SERVER = Authentication Provider
ORY HYDRA = OAuth Token Manager

• You control WHO can login (user database)
• You verify passwords
• Ory trusts YOUR authentication decision
• Ory handles OAuth complexity

🎯 What We Implemented

1. User Authentication System (internal/users/)

File: users.go

What it does:

• Stores users in PostgreSQL
• Hashes passwords with bcrypt (cost 10)
• Authenticates users (email + password verification)
• Manages user CRUD operations

Key Functions:

NewUserStore(databaseURL) → Connects to PostgreSQL, creates tables
AddUser(email, password, name) → Adds user with hashed password
Authenticate(email, password) → Verifies credentials
GetUser(email) → Retrieves user info
ListUsers() → Returns all users (no passwords)
DeleteUser(email) → Removes user

... [View full README on GitHub](https://github.com/vishalk17/indian-store-mcp-server#readme)