Frontmatter
| id | 9589 |
| title | Implement OIDC/OAuth Authorization for KB and Memory MCP Servers (Restoration of #9558) |
| state | Closed |
| labels | enhancementdeveloper-experienceaiarchitecture |
| assignees | [] |
| createdAt | Mar 29, 2026, 12:01 PM |
| updatedAt | Mar 29, 2026, 12:01 PM |
| githubUrl | https://github.com/neomjs/neo/issues/9589 |
| author | tobiu |
| commentsCount | 0 |
| parentIssue | null |
| subIssues | [] |
| subIssuesCompleted | 0 |
| subIssuesTotal | 0 |
| blockedBy | [] |
| blocking | [] |
| closedAt | Mar 29, 2026, 12:01 PM |
Implement OIDC/OAuth Authorization for KB and Memory MCP Servers (Restoration of #9558)
Closedenhancementdeveloper-experienceaiarchitecture
Note: This issue was created to restore the accidentally deleted issue #9558 for historical record and changelog integrity.
Implement out-of-the-box OAuth 2.1 / OIDC authorization for the Knowledge Base and Memory Core MCP servers. This enables IaC-driven deployments using standard identity providers like Keycloak.
Requirements:
AUTH_HOST,AUTH_PORT,AUTH_REALM,OAUTH_CLIENT_ID, andOAUTH_CLIENT_SECRETinaiConfig.mjs.Server.mjs(for bothknowledge-baseandmemory-core):mcpAuthMetadataRouterfor discovery.tokenVerifierusing standard token introspection.requireBearerAuthmiddleware to the SSE transport.authMiddlewareescape hatch remains functional.