SSE Server Authorization

[robert-jackson-glean]

I noticed in the README that this plugin now supports SSE based servers as well as STDIO, great work!!! I am working on setting up an SSE based server for some work projects and wanted to try it out.

I have a couple of high level questions though:

• How does the SSE flow support OAuth? The example in the README just has the end user providing the bearer token in the config, but I'd prefer to use the OAuth flow within the client connection instead of providing the token up front. Is that possible to your knowledge?
• Is it possible to load the authorization token some other way than via inlining to the file? I'd like to either use op (1Password's CLI) to execute and return it or just load it from an environment (that I could configure).

[ravitemer]

How does the SSE flow support OAuth? The example in the README just has the end user providing the bearer token in the config, but I'd prefer to use the OAuth flow within the client connection instead of providing the token up front. Is that possible to your knowledge?

@robert-jackson-glean Unfortunately it currently just supports authorization via the headers. And there is no other way than to inline them.
I will soon add this functionality. And what server are you using if not something private, so that I can test the ideal flow for a neovim user.

If it's a server that is available in some platform like composio you can add a connection there and just enter url in the config.

[robert-jackson-glean]

Yeah, right now I'm working on creating a private server (though we might end up with a public demo version? I'm not 100% sure). I'm trying to aim to support the latest spec version (2025-03-25) with the authorization details, and really would prefer to test in my favorite editor 😝 (instead of a VSCode-a-like).

[robert-jackson-glean]

RE: Composio, they don't really follow the authorization parts of the spec (my coworker and I did a deep dive of how they have it working the other day). They create a unique endpoint URL for each user, this way the tools listing shown is guaranteed to be unique to the user without authorization first. Then upon first tool invocation, they do the authorization step. I believe this is done because the original spec didn't account for the SSE server returning a 401 and the client automatically handling the OAuth flow.

As far as I can tell, the latest spec specifically allows us to avoid needing a custom endpoint per user, I'd rather have URLs for my hosted MCP server to be like foo.com/mcp/me/ where we have stable endpoints for the user (though they can still customize the tools they want). Upon first request (if no custom authorization header were provided):

1. the server would return a 401
2. the client would then find the https://foo.com/.well-known/oauth-authorization-server info
3. the client then does the oauth flow (e.g. launching the browser and whatnot)
4. the client then retries the initial request with the correct bearer token

[ravitemer]

Thanks @robert-jackson-glean. Yeah, I am also having second thoughts on integrating third party marketplaces like smithery, composio into this plugin. We might have to have sort of our own community backed marketplace.

the server would return a 401
the client would then find the https://foo.com/.well-known/oauth-authorization-server info
the client then does the oauth flow (e.g. launching the browser and whatnot)
the client then retries the initial request with the correct bearer token

Regarding the latest spec, I understood the spec and it seems solid. But are there any public servers you know of I can test with. Will rlook more into it and try to add support as soon as possible.

[robert-jackson-glean]

Regarding the latest spec, I understood the spec and it seems solid. But are there any public servers you know of I can test with. Will rlook more into it and try to add support as soon as possible.

No, I've also been wanting to test out a few public ones and didn't find many 😞 . The new spec is only ~ 3 weeks old or so, and there aren't a ton of clients that support it yet. Composio is still using the prior spec version (and only uses SSE directly with cursor, in claude desktop and windsurf it's using a stdio-to-sse bridge locally).

[ravitemer]

Yeah! Will see If I can find any. If not, might have to test with a local dev server. Will let you know how this goes.

[ravitemer]

@robert-jackson-glean This is implemented with v4.10.0

Please see the #99 discussion

Let me know if you are having any issues