M7. MCP authorization (OAuth code flow)
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- azure, csharp
- Domain
- authentication, authorization, cli, security
Research direction
Start with docs/mcp.md and docs/agentic-roadmap.md, especially roadmap item M7, then trace the HTTP transport and existing Entra/RBAC credential path. Done means remote unauthenticated requests are rejected, bearer-token authorization works, identity reaches Cosmos/ARM credentials, localhost no-auth remains flag-gated, and the threat model and documentation are updated.
Written by the indexing model from the issue text.
Description
Why
Today the MCP server relies solely on origin-header validation and localhost binding — safe for a single-user local machine, but there is no authorization layer. Any remote, hosted, or shared agent deployment (team agent, CI runner, cloud-hosted assistant) currently has no supported way to authenticate a caller. The MCP spec defines an OAuth 2.1 authorization-code flow for exactly this; adopting it unlocks hosted/agentic scenarios without falling back to master keys.
This is the natural companion to confirmation/elicitation (item M3): authorization answers "who is allowed to call," M3 answers "what may they do."
Proposed behavior
- Implement the MCP authorization-code flow for the HTTP transport: advertise the authorization server, validate bearer tokens on each request, and map the authenticated identity onto the shell's existing Entra/RBAC connection so tool calls run with least-privilege, per-caller credentials rather than a shared session.
- Keep localhost/no-auth as an explicit opt-in for the current single-user experience.
Acceptance criteria
- Unauthenticated remote requests are rejected.
- A client can complete the authorization-code flow and call tools with a bearer token.
- Identity flows to the Cosmos/ARM credential.
- Localhost no-auth mode preserved behind a flag.
- Threat model +
docs/mcp.mdupdated.
Filed from the Agentic & Automation Roadmap (docs/agentic-roadmap.md), item M7, Wave 2. Priority P1.
- Dominant language
- C#
- Stars
- 3
- Forks
- 7
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 18
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from Azure/CosmosDBShell
-
automation P1
Difficulty 5/5 Over a week Newbie friendliness 45/100
Azure/CosmosDBShell#178 · 1 comment ·
-
automation P1
Difficulty 5/5 Over a week Newbie friendliness 35/100
Azure/CosmosDBShell#175 · 1 comment ·
-
agentic enhancement P0
Difficulty 4/5 3-5 days Newbie friendliness 55/100
Azure/CosmosDBShell#153 · 1 comment ·
-
Difficulty 5/5 Over a week Newbie friendliness 30/100
Azure/CosmosDBShell#118 · 1 comment ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 45/100
Azure/CosmosDBShell#107 · 3 comments ·
All issues in Azure/CosmosDBShell
Similar issues
-
Status: Waiting triage Type: Bug
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
nanoframework/Home#1857 ·
-
kind/bug kind/regression
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
unoplatform/uno.toolkit.ui#1646 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
nightscout/nocturne#1379 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
elastic/esql-dotnet#47 ·
-
Difficulty 1/5 Under an hour Newbie friendliness 85/100