OAuth 2.1 browser login for FastMCP servers whose login is a form checked by the service behind them
Wellknown found it in public sources; nobody has proven control of it yet. Claiming takes one click if the repository is under your GitHub account, or a small file on your domain otherwise. Verified owners get the badge, 15-minute checks, status alerts, edits that outrank crawled data, and a ranking boost.
Agents can do it too: POST https://wellknown.network/api/v1/claims with {"agent":"mcp-login-oauth","method":"well_known_file"} — machine-readable steps at claim.json, guide at /docs/claim.
Everything here was measured by our prober or read from a registry. Nothing is self-reported.
Attributed to the source that supplied each field. Treated as claims, not facts.
# mcp-login-oauth OAuth 2.1 browser login for [FastMCP](https://gofastmcp.com) servers that sit in front of another service. Clients that can't send a token header, such as claude.ai, the Claude desktop and mobile apps, log in once with a form. The form is checked by the service behind the server, for example a Trilium password, an InvoiceNinja email, password and 2FA code, or a Paperless username and password. The client then only holds opaque OAuth tokens. Your server turns each login into a *grant*, such as a service token minted at login, and reads it back in tool code. The library provides: - dynamic client registration, PKCE, refresh rotation and revocation, including revocation for public clients, which the MCP SDK's own `/revoke` rejects; - a Fernet-encrypted file store that survives restarts; - the login page with configurable fields, hints and collapsed sections for alternative logins, and honest dead-end pages for broken flows; - tokens bound to this server (RFC 8707 resource indicators) and the issuer named on the code redirect (RFC 9207); - protection against password guessing: a delay after each failed login, and login links that end after 5 failures or 10 minutes; - optional static header tokens next to OAuth. What this library [stands for](https://mcp-login-oauth.marceltov.de/values/) and [where it is going](https://mcp-login-oauth.marceltov.de/roadmap/) are on the [documentation site](https://mcp-login-oauth.marceltov.de/). **TypeScript?** This library is Python only; TypeScript apps sign in with Better Auth, see [Coming from TypeScript](https://mcp-login-oauth.marceltov.de/typescript/). Used by [trilium-mcp](https://github.com/Marceltov/trilium-mcp), [invoiceninja-mcp](https://github.com/Marceltov/invoiceninja-mcp), [paperless-ngx-mcp](https://github.com/Marceltov/paperless-ngx-mcp) and the recall engine in [trilium-llm-wiki](https://github.com/Marceltov/trilium-llm-wiki). ## Install From PyPI: ```bash uv add mcp-login-oauth ``` N…
Mapped onto the structured taxonomy from declared text and observed tool names. Confidence shown for derived entries.
Every source is kept verbatim. Field changes are logged as events.