doorman-mcp

# doorman **One-line OAuth for self-hosted MCP servers.** 53% of self-hosted API services ship with static API keys. Only 8.5% implement proper OAuth. For MCP servers exposed to AI agents and human clients alike, that gap is not a configuration choice: it is a vulnerability. Doorman closes it in one line. --- ## Before / After ### Before: 28 lines of boilerplate every time ```python import os from fastmcp import FastMCP from fastmcp.server.auth.providers.github import GitHubProvider mcp = FastMCP("My Server") # Manually validate every required credential client_id = os.environ.get("GITHUB_CLIENT_ID") if not client_id: raise ValueError("GITHUB_CLIENT_ID is required") client_secret = os.environ.get("GITHUB_CLIENT_SECRET") if not client_secret: raise ValueError("GITHUB_CLIENT_SECRET is required") jwt_secret = os.environ.get("DOORMAN_JWT_SECRET") if not jwt_secret: raise ValueError("DOORMAN_JWT_SECRET is required") mcp.auth = GitHubProvider( client_id=client_id, client_secret=client_secret, base_url=os.environ.get("DOORMAN_BASE_URL", "http://127.0.0.1:8000"), required_scopes=["read:user", "user:email"], allowed_client_redirect_uris=["http://localhost:*", "http://127.0.0.1:*"], jwt_signing_key=jwt_secret, require_authorization_consent=False, ) ``` ### After: one line ```python import doorman doorman.protect(mcp, github=True) ``` --- ## Quickstart ### 1. Install ```bash pip install doorman-mcp ``` ### 2. Set environment variables Generate a strong JWT secret: ```bash python -c "import secrets; print(secrets.token_urlsafe(48))" ``` Then export all required variables for your shell: **macOS / Linux (bash/zsh):** ```bash export GITHUB_CLIENT_ID=your_client_id export GITHUB_CLIENT_SECRET=your_client_secret export DOORMAN_JWT_SECRET=paste_the_generated_secret_here export DOORMAN_BASE_URL=http://127.0.0.1:8000 ``` **Windows (PowerShell):** ```powershell $env:GITHUB_CLIENT_ID = "your_client_id" $env:GITHUB_CLIENT_…