{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_wefjwzadf5g7","handle":"django-mcp-oauth","url":"https://wellknown.network/agents/django-mcp-oauth","links":{"self":"https://wellknown.network/agents/django-mcp-oauth/record.json","html":"https://wellknown.network/agents/django-mcp-oauth","markdown":"https://wellknown.network/agents/django-mcp-oauth/record.md","api":"https://wellknown.network/api/v1/agents/django-mcp-oauth","status":"https://wellknown.network/api/v1/agents/django-mcp-oauth/status","claim":"https://wellknown.network/agents/django-mcp-oauth/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/django-mcp-oauth/claim.json","badge":"https://wellknown.network/agents/django-mcp-oauth/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/django-mcp-oauth/history","tools":"https://wellknown.network/api/v1/agents/django-mcp-oauth/tools"},"ard":{"identifier":"urn:air::server:django-mcp-oauth","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"django-mcp-oauth","summary":"An OAuth 2.1 authorization server for MCP resource servers, as a Django app: RFC 9728/8414/7591/7517/6750 profile, PKCE, refresh rotation, client-credentials service accounts.","description":"# django-mcp-oauth\n\nAn OAuth 2.1 authorization server for MCP resource servers, as a Django app.\n\nBuilt on Authlib's Django integration plus PyJWT/cryptography, with the MCP\nprofile wired on top:\n\n- RFC 9728 protected-resource metadata, RFC 8414 authorization-server\n  metadata, RFC 7517 JWKS — all under `/.well-known/`\n- RFC 7591 dynamic client registration, with the public-client rule (a\n  `token_endpoint_auth_method: none` client is never issued a secret, and the\n  response omits the field as the RFC requires)\n- Authorization-code grant with PKCE (S256) required, RS256 JWT access tokens\n  bound to the resource audience\n- Refresh-token rotation with a configurable grace window, so concurrent\n  agents sharing a connection do not strand each other with a dead credential\n- Client-credentials grant for service accounts, each bound to a Django user\n- RFC 6750 / 9728 `WWW-Authenticate` challenges for the resource server\n- Client secrets stored hashed\n\nThe one product decision — *may this signed-in user authorize an MCP\nclient?* — is a dotted-path setting. Everything else is configuration.\n\n## Install\n\n```bash\npip install django-mcp-oauth          # + [drf] for the REST Framework class\npython manage.py generate_oauth_keys   # prints a private key PEM to set as MCP_OAUTH_PRIVATE_KEY\n```\n\n```python\nINSTALLED_APPS += [\"django_mcp_oauth\"]\n\nMCP_OAUTH_ISSUER = \"https://example.com\"          # the AS origin (iss)\nMCP_RESOURCE_URL = \"https://example.com/mcp\"      # the MCP server (aud)\nMCP_OAUTH_PRIVATE_KEY = os.environ[\"MCP_OAUTH_PRIVATE_KEY\"]\nMCP_OAUTH_AUTHORIZE_USER = \"myapp.access.may_use_mcp\"   # callable(user) -> bool\nMCP_OAUTH_CONSENT_TEMPLATE = \"myapp/consent.html\"       # optional; receives grant, client, scope\n```\n\n```python\n# urls.py — both lists at the site root\nfrom django_mcp_oauth.urls import oauth_urlpatterns, wellknown_urlpatterns\nurlpatterns += wellknown_urlpatterns + oauth_urlpatterns\n```\n\nOptional settings and their defaults are listed in `django_mcp_oauth/co…","publisher":null,"homepage":"https://github.com/BrandonLewis/django-mcp-oauth","repository":"https://github.com/BrandonLewis/django-mcp-oauth/blob/main/CHANGELOG.md","version":"0.1.0","license":null,"protocols":["mcp"],"tags":["mcp"],"pricing":null,"endpoints":[{"url":"pypi:django-mcp-oauth","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi"}},"derived":{"capabilities":[{"slug":"security.identity","name":"Identity & Access","confidence":1,"provenance":"derived"},{"slug":"security.secrets","name":"Secrets Management","confidence":0.848,"provenance":"derived"}],"categories":["security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"django-mcp-oauth","registry":"pypi","observedAt":"2026-11-05T21:26:36.674Z","publishedAt":"2026-10-16T20:59:48.417337Z","latestVersion":"0.1.0"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"django-mcp-oauth","url":"https://pypi.org/project/django-mcp-oauth/","firstSeenAt":"2026-10-18T16:28:37.229Z","fetchedAt":"2026-11-05T21:25:08.575Z","normalizedAt":"2026-11-05T21:25:08.575Z"}]},"firstSeenAt":"2026-10-18T16:28:37.229Z","updatedAt":"2026-11-05T21:26:36.674Z"}