Self-hosted MCP: support OAuth 2.0 (external IdP) for /api/mcp #3399

What are you trying to do?

Put the self-hosted MCP endpoint (/api/mcp) behind our org IdP (Okta) so users authenticate via SSO instead of Personal API
Access Keys. Today /api/mcp only accepts access keys (validateUserAccessKey in packages/api/src/mcp/app.ts). Keys are long-
lived, manually distributed, and outside IdP lifecycle (offboarding, MFA, session policy). MCP clients that attempt OAuth
discovery also fail against self-hosted (#2162).

Current behavior (main, 2.41.0):

• 401 without WWW-Authenticate
• No /.well-known/oauth-protected-resource
• No config/env vars for an authorization server

What would you like to see?

Opt-in OAuth resource-server mode via env vars; access-key auth stays the default:

• MCP_OAUTH_ISSUER: authorization server issuer URL
• MCP_OAUTH_AUDIENCE: expected aud
• MCP_OAUTH_USER_CLAIM: claim mapped to a HyperDX user (default email)

When set:

1. Serve RFC 9728 protected-resource metadata pointing to the issuer.
2. Return 401 with WWW-Authenticate: Bearer resource_metadata="...".
3. Validate JWT (JWKS, iss, aud, exp) via the SDK's requireBearerAuth.
4. Resolve req.user from the claim; 403 if no matching user/team.

Out of scope: HyperDX acting as an authorization server; dynamic client registration.

Alternatives you've considered

• Reverse proxy that validates IdP tokens and injects an access key. Works, but loses per-user identity unless tokens are manually
  mapped to per-user keys.
• Maintaining a fork with the change above. Works, but needs rebasing every release.

Anything else?

• Area: API (packages/api/src/mcp/app.ts, packages/api/src/middleware/auth.ts)
• Related: Self-hosted MCP: SDK OAuth handshake fails with HTTP 405 before Bearer token is used #2162
• Spec: https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization
• Happy to contribute a PR once scope is agreed.

New issues start as Needs Feedback so we can discuss scope before anyone
writes code. Once a maintainer swaps that for Accepting PR, the issue is ready
to be picked up — see
CONTRIBUTING.md.