Summary
- Developed a production-ready OAuth 2.1 MCP (Model Context Protocol) Authentication Server using Next.js 15.
- Implemented secure, third-party delegated authentication with Google.
- Engineered an innovative redirect URI management solution to resolve critical compatibility issues between secure server standards and the
mcp-remoteclient.
This project represents a complete implementation of a Model Context Protocol (MCP) server with secure OAuth 2.1 authentication using Google as the identity provider. Built on Next.js 15, it demonstrates how to create production-ready MCP servers that integrate seamlessly with modern development tools like VS Code and Claude Desktop.
The genesis of this project stemmed from extensive research into the MCP landscape, searching for existing implementations that combined Next.js, mcp-remote compatibility, OAuth 2.1 compliance, and third-party authentication delegation. Despite thorough investigation across GitHub repositories, documentation, and YouTube tutorials, no complete reference implementation existed that addressed all these requirements simultaneously. This discovery highlighted a critical need for a production-ready template that demonstrates proper MCP authentication patterns.
(Martinez, 2025)
Notice: We used Google as the 3rd Party Auth Server instead of Auth0
The authentication architecture implements what could be considered a Third-Party Delegated Authentication pattern, where the MCP server acts as an OAuth intermediary rather than handling user credentials directly. This approach leverages existing identity infrastructure by delegating the actual authentication process to Google’s trusted authorization servers. The flow begins when an MCP client initiates OAuth with the server, which then redirects users to Google for authentication, receives the authorization response, and generates its own MCP-specific tokens bound to the Google session.
This delegation pattern offers significant advantages over traditional authentication approaches. Organizations can leverage their existing Google Workspace or consumer Google accounts without requiring separate credential management. The MCP server never handles user passwords or sensitive authentication data, reducing security liability while maintaining full OAuth 2.1 compliance. Users benefit from familiar authentication experiences and single sign-on capabilities across their development tools.
A particularly challenging aspect of the implementation involved solving compatibility issues with mcp-remote, where architectural assumptions in the client tool conflicted with proper OAuth 2.1 server implementations. The research process revealed that mcp-remote expects localhost redirect URIs for port detection (as of September 13, 2025), but deployed secure servers use server-domain URIs. The solution required innovative redirect URI management that satisfies both security standards and tool compatibility requirements.
The project also pioneered the integration of RFC-compliant discovery mechanisms specifically for MCP servers. By implementing both authorization server metadata (RFC 8414) and protected resource metadata (RFC 9728), the server enables automatic client configuration and capability detection.