01 · ABOUT

What ext-auth does

Official repository of MCP authorization extensions

Why teams reach for it: Adds modular MCP authorization mechanisms beyond the core protocol, including enterprise-managed SSO and machine-to-machine authentication without user interaction.

Worth knowing

This repository follows the Model Context Protocol Governance process with dedicated maintainers for authorization extensions

Self-hostedOpen SourceMDXMCP Server & Client
02 · TECHNICAL SPECIFICATIONS

How ext-auth compares

Fields the vendor doesn't document are left blank here rather than guessed — a blank means nothing verified, not a "no."

Oauth Version
OAuth 2.1
Client Registration
CIMD only
Resource Indicators (RFC 8707)
Yes
Protected Resource Metadata (RFC 9728)
Yes
Authorization Server Metadata (RFC 8414)
Yes
Pkce
Required
Token Exchange (RFC 8693)
Yes
Agent Delegation
Carried in token
Idp Federation
Enterprise-Managed Authorization
Upstream Token Vault
No
Audit Log
No
03 · NEW TO MCP?
Who can connect, and what may they do?

Authorization & identity tools control who — or which AI agent — is allowed to connect, and what they're allowed to do once connected.