MCP Server Playground

A playground for Model Context Protocol (MCP) server built with TypeScript and Streamable HTTP transport with an OAuth Proxy for 3rd party authorization servers like Auth0.

Features

• MCP 2025-06-18 Compliant: Full compliance with the latest MCP specification including SSE resumability, tool annotations, and structured content.
• MCP Server implementation: HTTP-Based Streamable transport using @modelcontextprotocol/sdk with HTTP transport, session management, and tool execution.
• SSE Resumability: Clients can reconnect with Last-Event-ID header to resume receiving events after connection breaks, powered by EventStore.
• OAuth authentication/3rd party authorization: Implements an OAuth server for MCP clients with RFC 8707 Resource Indicators and RFC 9728 authorization discovery, delegating to Auth0.
• Storage: Pluggable storage abstraction (Memory/Valkey) with EventStore for SSE event persistence and replay.
• Session Management: Support stateful sessions by using replay of initial request for distributed deployments.
• Security: Strict Origin validation to prevent DNS rebinding attacks, WWW-Authenticate headers for authorization discovery.
• Tools:
  • aws-ecs: Investigate the ECS service, task and cloudwatch logs using AWS ECS, Cloudwatch Logs and Bedrock
  • aws-s3: Get the list of S3 buckets and objects
  • system-time: Get the current system time in various formats with timezone support
  • echo: Echo a message back with transformations, repetition
  • streaming: Simulate real-time streaming data with live updates
  • project: Find keywords in the current project directory
• Resources:
  • echo://documentation: Documentation for the echo tool (static resource)
  • echo://result/{resultId}: Access echo operation results (resource template)
• Prompts: echo

Documentation

• Architecture Overview - System design, data flows, and diagrams
• Environment Variables - Configuration options
• Tool Documentation (in each tool directory):
  • echo - Message echo with transformations
  • system-time - Current time with timezone support
  • streaming - Real-time data streaming simulation
  • project - Keyword search in project files
  • aws-ecs - ECS investigation with AI analysis
  • aws-s3 - S3 bucket and object listing
• Resource Documentation: src/resources/README.md - MCP resources overview

Why this project exists?

• The Model Context Protocol spec requires Dynamic Application Registration because it provides a standardized way for MCP clients to automatically register with new servers and obtain OAuth client IDs without user interaction. The main reason for this mechanism is because MCP clients can't know all possible services in advance and manual registration would create significant effort for users and it is not scalable. If do not support Dynamic Application Registration, then MCP clients need to provide OAuth client ID and secret to the server, which is not secure and not scalable.
• However, enabling Dynamic Application Registration (if supported) becomes a security risk because the endpoint is a public endpoint that anyone can create OAuth clients. It can easily be abused, such as by flooding with unwanted client registrations. Hence, Auth0 has disabled Dynamic Application Registration
• As a result, this project provides a way to enable Dynamic Application Registration for MCP server by using OAuth Proxy, but delegating authorization to 3rd party aut

... View full README on GitHub