enzomar/fastauthmcp

FastAuthMCP adds identity and authentication to MCP servers, the tool interfaces that let AI agents like Claude or Gemini call functions in your codebase. Normally, when an AI agent calls one of your tools, there is no built in way to know which human is behind that request, what they are allowed to do, or how to pass their credentials along to another service. Every team building these servers ends up building that logic from scratch. FastAuthMCP is meant to remove that repeated work. It sits between the AI client and your tool functions. You install it with pip, then change a single import line so your existing tools use it instead of plain FastMCP. Without any extra setup it behaves exactly like a normal MCP server. Add a small YAML config file naming an identity provider, and your tool functions gain two helpers: one that tells you who is calling, and one that hands you a valid, automatically refreshed token to forward to another API on that person's behalf. A decorator lets you restrict a tool to specific roles, like admin only. It supports three login patterns: a browser based login for desktop apps like Claude Desktop or Cursor, a token exchange flow for cloud based agents such as Gemini where no browser is available, and a machine to machine mode using a client ID and secret for unattended services. It is compatible with common identity providers including Zitadel, Keycloak, Auth0, Azure Entra ID, Okta, and Google Cloud, each with a setup guide. The project includes an automated test suite of 34 scenarios checking that authentication, role based authorization, and security cases like expired or mismatched tokens behave correctly across providers. It requires Python 3.11 or newer and is released under the Apache 2.0 license. It is a new, single star project as of mid July 2026, so it should be treated as early stage software rather than a widely proven tool.