A Model Context Protocol (MCP) proxy that adds an OAuth/OIDC frontend to upstream MCPs that don't include any such — either because they only validate tokens or expect static credentials such as API keys. Bridges to a configurable IdP (Keycloak, AWS Cognito, Google, Azure, generic OIDC) for Claude …
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"authsome-mcp-proxy","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
<!-- omit from toc --> # Authsome MCP Proxy A [Model Context Protocol](https://modelcontextprotocol.com) (MCP) proxy that bridges *upstream MCP servers protected by token validation or static credentials* to MCP clients such as Claude Desktop, Claude Code, Cursor, Codex, MCP Inspector, and Claude.ai. ("Authsome" as in *awesome*, but with auth.) The proxy can run as: - **Web connector** (`--transport http`, **recommended for end users**) — a persistent HTTP server that any MCP client reaches by URL. Downstream clients authenticate against the proxy via Dynamic Client Registration or a Client ID Metadata Document; the proxy bridges to your IdP and forwards traffic upstream. A single instance can serve many users simultaneously and lives behind a normal URL (`https://mcp.example.com/mcp`) — no per-user config files, subprocess launchers, or local Python toolchains. This is the default for non-developer rollouts and the only mode that works with web-only clients like Claude.ai. - **Local stdio proxy** (`--transport stdio`, the default for backwards compatibility, **developer use**) — launched as a subprocess by the MCP client (Claude Desktop, Cursor, Codex, Claude Code via `claude mcp add --transport stdio`). Each user runs their own instance and the proxy performs the OAuth flow against an external OIDC IdP on their behalf. Useful when you don't have a server to host the proxy on or when the upstream MCP only validates tokens and you want each developer to authenticate locally. - [What Is This For?](#what-is-this-for) - [Prerequisites](#prerequisites) - [Web Connector (Recommended)](#web-connector-recommended) - [How it works](#how-it-works) - [Keycloak](#keycloak) - [Generic OIDC](#generic-oidc) - [AWS Cognito](#aws-cognito) - [Google](#google) - [Azure (Entra ID)](#azure-entra-id) - [Connecting downstream MCP clients](#connecting-downstream-mcp-clients) - [Identity advertised to downstream clients](#identity-adver…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.