A production-ready template for building remote MCP servers with OAuth 2.1 authentication and JWT passthrough. It enables per-user authorization and proxies tool calls to existing backend APIs.
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
process.env. You'll be asked to provide them before it can run.ALLOWED_ORIGINS— CORS on these is locked to the auth app origin ().AUTH_APP_URL— 4. MCP validates the params, parks them as a short-lived mcp_session, and 302-redirects the browser to /oauth/authorize?mcp_session=....BACKEND_API_URL— 1. Point it at your API. Set and JWT_VERIFY_PATH (the endpoint that returns the current user for a Bearer token, e.g. /api/auth/me). That endpoint is all the MCP server needs from your backend.JWT_VERIFY_PATH— 1. Point it at your API. Set BACKEND_API_URL and (the endpoint that returns the current user for a Bearer token, e.g. /api/auth/me). That endpoint is all the MCP server needs from your backend.MCP_PUBLIC_URL— The MCP server is a plain Node.js Express app. The only hard requirement: it MUST be reachable over HTTPS at — Claude will not complete OAuth against plain HTTP.MCP_URLMOCK_JWT_SECRETMOCK_PORTPORT— no (default 4000) Local listen port[](https://m8ven.ai/mcp/mstfbysl-remote-mcp-oauth-template-5zyjik)