Your MCP Server Needs
Real Authorization.

API keys and hardcoded JWTs are fine for demos. For production, you need consent, scoped permissions, revocation, and an audit trail.

createMcpAuthServer() registers everything an MCP client needs to discover, register, authorize, and manage tokens.

Install the package, create the server, protect your routes. MCP clients auto-discover your auth endpoints via the well-known metadata URL.

npm install @grantex/mcp-auth @grantex/sdk

import { Grantex } from '@grantex/sdk';
import { createMcpAuthServer } from '@grantex/mcp-auth';

const grantex = new Grantex({
  baseUrl: 'https://grantex-auth-dd4mtrt2gq-uc.a.run.app',
  apiKey: process.env.GRANTEX_API_KEY,
});

const authServer = await createMcpAuthServer({
  grantex,
  agentId: 'ag_your_mcp_server',
  scopes:  ['tools:read', 'tools:execute', 'resources:read'],
  issuer:  'https://your-mcp-server.example.com',
});

await authServer.listen({ port: 3001 });

import express from 'express';
import { requireMcpAuth } from '@grantex/mcp-auth/express';

const app = express();

// Protect all MCP tool routes
app.use('/mcp', requireMcpAuth({
  issuer: 'https://your-mcp-server.example.com',
  scopes: ['tools:execute'],
}));

// Decoded grant available on every request
app.post('/mcp/tools/call', (req, res) => {
  const grant = req.mcpGrant;
  console.log(grant.agentDid, grant.scopes);
  res.json({ result: 'tool executed' });
});

Prove your MCP server implements OAuth 2.1 correctly. Three tiers, automated conformance testing, and a listing in the Grantex MCP Registry visible to 10,000+ developers.

Every certified server appears in the Grantex registry with its tier, scopes, and a direct install link. Users can trust that listed servers meet OAuth 2.1 requirements.

Use Grantex Cloud for zero-infrastructure auth, or run the full stack on your own infrastructure. The code is identical — just point the SDK at a different URL.

const server = await createMcpAuthServer({
  grantex: new Grantex({
    baseUrl: 'https://grantex-auth-dd4mtrt2gq-uc.a.run.app',
    apiKey:  process.env.GRANTEX_API_KEY,
  }),
  agentId: 'ag_your_server',
  scopes:  ['tools:read', 'tools:execute'],
  issuer:  'https://your-domain.example.com',
});

const server = await createMcpAuthServer({
  grantex: new Grantex({
    baseUrl: 'https://auth.your-company.internal',
    apiKey:  process.env.GRANTEX_API_KEY,
  }),
  agentId: 'ag_internal_server',
  scopes:  ['internal:read', 'internal:write'],
  issuer:  'https://auth.your-company.internal',
  // Persistent storage for client registrations
  clientStore: new PostgresClientStore(),
});

Every security decision follows the OAuth 2.1 specification. No implicit grant, no password grant, no symmetric signing, no plain PKCE.