🤖mcp server oauth

[AntoLC]

Purpose

This PR lays the groundwork for an MCP server for Docs (docs-mcp): a remote MCP server exposing three tools backed by the Django API:

• search_documents
• read_document
• create_document

It is an OAuth-protected resource server: MCP clients authenticate the user against Keycloak (Authorization Code + PKCE, public docs-mcp-client), and the server forwards that same access token, unchanged, to Django.

Django stays the sole authority on document permissions — ResourceServerAuthentication (django-lasuite) introspects the token on every call and the existing DocumentViewSet permissions/querysets decide access.

There is deliberately no RFC 8693 token exchange: the TypeScript server (Express + @modelcontextprotocol/sdk, stateless Streamable HTTP) holds no credentials of its own, only reading Keycloak's public JWKS to verify signatures.

We're eager to hear from people using it and to see it augmented — more tools, richer document operations, DCR, token exchange — so please try it and tell us what you need.

How to do

To start the mcp server, as usual:

• make build
• make run

When your MCP is running, you can check that everything is fine by checking it with mcp-inspector, by running:

• make mcp-inspector
  

  docs/Makefile

  Lines 528 to 530 in b7f3bec

  	mcp-inspector: ## Launch the MCP Inspector against docs-mcp with the client/scopes pre-filled
  	cd src/frontend/servers/mcp && yarn mcp-inspector
  	.PHONY: mcp-inspector

You can use it with your favorite LLM (Claude, Codex, Cursor...), here some helpers to plug it easily:

• make mcp-claude
• make mcp-codex

More here:

docs/Makefile

Lines 462 to 527 in b7f3bec

	mcp-claude: ## Connect Claude Code to docs-mcp and launch it (authenticate with `/mcp` on first use)
	@test -f .mcp.json || printf '%s\n' \
	'{' \
	' "mcpServers": {' \
	' "docs-mcp": {' \
	' "type": "http",' \
	' "url": "http://localhost:4455/mcp",' \
	' "oauth": {' \
	' "clientId": "docs-mcp-client",' \
	' "callbackPort": 8090' \
	' }' \
	' }' \
	' }' \
	'}' \
	> .mcp.json
	claude
	.PHONY: mcp-claude
	mcp-codex: ## Connect Codex CLI to docs-mcp and launch it (authenticate with `codex mcp login docs-mcp` on first use)
	@mkdir -p .codex
	@test -f .codex/config.toml || printf '%s\n' \
	'# docs-mcp: fixes the local OAuth callback port so it can be pre-registered as a' \
	'# Keycloak redirect URI (docker/auth/realm.json, docs-mcp-client). See' \
	'# documentation/mcp_server.md.' \
	'mcp_oauth_callback_port = 8091' \
	> .codex/config.toml
	codex mcp add docs-mcp --url http://localhost:4455/mcp --oauth-client-id docs-mcp-client 2>/dev/null || true
	codex
	.PHONY: mcp-codex
	mcp-cursor: ## Open this project in Cursor with docs-mcp connected (authenticate docs-mcp from Cursor's MCP settings on first use)
	@mkdir -p .cursor
	@test -f .cursor/mcp.json || printf '%s\n' \
	'{' \
	' "mcpServers": {' \
	' "docs-mcp": {' \
	' "url": "http://localhost:4455/mcp",' \
	' "auth": {' \
	' "CLIENT_ID": "docs-mcp-client"' \
	' }' \
	' }' \
	' }' \
	'}' \
	> .cursor/mcp.json
	cursor .
	.PHONY: mcp-cursor
	mcp-gemini: ## Connect Gemini CLI to docs-mcp and launch it (approve the OAuth prompt on first use)
	@mkdir -p .gemini
	@test -f .gemini/settings.json || printf '%s\n' \
	'{' \
	' "mcpServers": {' \
	' "docs-mcp": {' \
	' "httpUrl": "http://localhost:4455/mcp",' \
	' "oauth": {' \
	' "enabled": true,' \
	' "clientId": "docs-mcp-client",' \
	' "redirectUri": "http://localhost:8092/oauth/callback"' \
	' }' \
	' }' \
	' }' \
	'}' \
	> .gemini/settings.json
	gemini
	.PHONY: mcp-gemini

Extensive documentation here:

https://github.com/suitenumerique/docs/blob/feat/mcp-server-oauth/documentation/mcp_server.md

[github-actions]

Size Change: 0 B

Total Size: 5.94 MB

📦 View Changed

Filename	Size	Change
apps/impress/out/_next/static/d9a7aec3/_buildManifest.js	0 B	-698 B (removed)	🏆
apps/impress/out/_next/static/f4fa8e54/_buildManifest.js	698 B	+698 B (new file)	🆕

_{compressed-size-action}