{"$schema":"https://wellknown.network/schemas/agent-record-v1.json","schemaVersion":"1","id":"ag_kkcjj3a2zc4m","handle":"mcp-login-oauth","url":"https://wellknown.network/agents/mcp-login-oauth","links":{"self":"https://wellknown.network/agents/mcp-login-oauth/record.json","html":"https://wellknown.network/agents/mcp-login-oauth","markdown":"https://wellknown.network/agents/mcp-login-oauth/record.md","api":"https://wellknown.network/api/v1/agents/mcp-login-oauth","status":"https://wellknown.network/api/v1/agents/mcp-login-oauth/status","claim":"https://wellknown.network/agents/mcp-login-oauth/claim","claimApi":"https://wellknown.network/api/v1/claims","claimDescriptor":"https://wellknown.network/agents/mcp-login-oauth/claim.json","badge":"https://wellknown.network/agents/mcp-login-oauth/badge.svg","openapi":"https://wellknown.network/openapi.json","history":"https://wellknown.network/api/v1/agents/mcp-login-oauth/history","tools":"https://wellknown.network/api/v1/agents/mcp-login-oauth/tools"},"ard":{"identifier":"urn:air::server:mcp-login-oauth","type":"application/mcp-server-card+json"},"kind":"mcp_server","declared":{"name":"mcp-login-oauth","summary":"OAuth 2.1 browser login for FastMCP servers whose login is a form checked by the service behind them","description":"# mcp-login-oauth\n\nOAuth 2.1 browser login for [FastMCP](https://gofastmcp.com) servers that sit in front of another\nservice. Clients that can't send a token header, such as claude.ai, the Claude desktop and mobile apps,\nlog in once with a form. The form is checked by the service behind the server, for example a Trilium\npassword, an InvoiceNinja email, password and 2FA code, or a Paperless username and password. The\nclient then only holds opaque OAuth tokens. Your server turns each login into a *grant*, such as a\nservice token minted at login, and reads it back in tool code.\n\nThe library provides:\n- dynamic client registration, PKCE, refresh rotation and revocation, including revocation for public\n  clients, which the MCP SDK's own `/revoke` rejects;\n- a Fernet-encrypted file store that survives restarts;\n- the login page with configurable fields, hints and collapsed sections for alternative logins, and\n  honest dead-end pages for broken flows;\n- tokens bound to this server (RFC 8707 resource indicators) and the issuer named on the code redirect\n  (RFC 9207);\n- protection against password guessing: a delay after each failed login, and login links that end after\n  5 failures or 10 minutes;\n- optional static header tokens next to OAuth.\n\nWhat this library [stands for](https://mcp-login-oauth.marceltov.de/values/) and [where it is going](https://mcp-login-oauth.marceltov.de/roadmap/) are on the [documentation site](https://mcp-login-oauth.marceltov.de/).\n\n**TypeScript?** This library is Python only; TypeScript apps sign in with Better Auth, see\n[Coming from TypeScript](https://mcp-login-oauth.marceltov.de/typescript/).\n\nUsed by [trilium-mcp](https://github.com/Marceltov/trilium-mcp),\n[invoiceninja-mcp](https://github.com/Marceltov/invoiceninja-mcp),\n[paperless-ngx-mcp](https://github.com/Marceltov/paperless-ngx-mcp) and the recall engine in\n[trilium-llm-wiki](https://github.com/Marceltov/trilium-llm-wiki).\n\n## Install\n\nFrom PyPI:\n\n```bash\nuv add mcp-login-oauth\n```\n\nN…","publisher":{"name":"Marcel Bruckner","url":null},"homepage":"https://mcp-login-oauth.marceltov.de/","repository":"https://github.com/Marceltov/mcp-login-oauth/releases","version":"0.2.3","license":null,"protocols":["mcp"],"tags":["authorization-server","fastmcp","login","mcp","oauth","oauth2"],"pricing":null,"endpoints":[{"url":"pypi:mcp-login-oauth","type":"package_pypi","auth":null,"probeable":false}],"skills":null,"tools":null,"extra":null,"attribution":{"kind":"pypi","name":"pypi","repoUrl":"pypi","summary":"pypi","version":"pypi","description":"pypi","homepageUrl":"pypi","publisherName":"pypi"}},"derived":{"capabilities":[{"slug":"security.identity","name":"Identity & Access","confidence":1,"provenance":"declared"}],"categories":["security"],"language":"en"},"observed":{"status":"unknown","statusReason":"Distributed as a package to run locally; no network endpoint to check.","lastOkAt":null,"lastProbedAt":null,"statusComputedAt":null,"reliability30d":null,"latestObservations":[],"tools":null,"package":{"name":"mcp-login-oauth","registry":"pypi","observedAt":"2026-11-05T22:26:19.212Z","publishedAt":"2026-11-03T07:06:04.630847Z","latestVersion":"0.2.3"},"toolSurface":null,"endpointFacts":[]},"verification":{"claimed":false,"claimedAt":null,"proofs":[]},"provenance":{"sources":[{"source":"pypi","key":"mcp-login-oauth","url":"https://pypi.org/project/mcp-login-oauth/","firstSeenAt":"2026-10-30T19:26:29.590Z","fetchedAt":"2026-11-05T22:24:17.188Z","normalizedAt":"2026-11-05T22:24:17.188Z"}]},"firstSeenAt":"2026-10-30T19:26:29.590Z","updatedAt":"2026-11-05T22:26:19.212Z"}