Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Expose OAuth metadata, pass token to API without validation

Open
#893 6 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
45/100
Issue type
Feature
Clarity
Mostly clear
Activity status
Quiet
Tech stack
csharp
Domain
api, authentication

Research direction

Start with the samples/ProtectedMcpServer example and trace the token validation and authorization flow around the custom TokenHandler and OnMessageReceived event. Reproduce the behavior with the non-JWT Google access token and determine whether the server can retain OAuth metadata while forwarding the token without local validation. Done means the supported behavior or limitation is demonstrated and documented.

Written by the indexing model from the issue text.

Description

area-auth enhancement P2 ready for work

I'm trying to create an MCP server that is simply a wrapper on top of an existing API, for example some Google API. I want the MCP server to expose corresponding authorization metadata (authorization server URL etc.) so the clients using this MCP can prompt the user to authenticate. However, I do not want to validate the Google token myself, and instead I just want to pass it as is to the corresponding Google API, which can do all the necessary validation on its side.

I tried following the ProtectedMcpServer example and was able to expose the authorization metadata, which seems to work pretty well, and my MCP client is able to authenticate and obtain a valid Google access token and send a valid Authorization header to the MCP.

But the issue was that the sample app also tries to validate the token, which fails because the token Google generates is not a valid JWT token (has only one dot in it). I was able to work around that by providing my own TokenHandler which always returns success, then I hit another issue when the framework tries to create an AuthenticationTicket, for which I had to set a Principal object and Success result in the OnMessageReceived event. But now I'm still getting 403 since some authorization is still taking place, and I'm not sure how to disable it, while still keeping OAuth metadata for MCP clients.

Is there any way to get this to work and just let the access token be passed to the underlying API without any additional validation? Or am I doing something completely wrong that I shouldn't be doing, which is not supported and is intentionally made hard to work around?

Dominant language
C#
Stars
4.5k
Forks
814
Avg merge
9d 19h
Merged PRs (30d)
4

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from modelcontextprotocol/csharp-sdk

All issues in modelcontextprotocol/csharp-sdk

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.