PHPackages sjs/neos-mcp-oauth - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. sjs/neos-mcp-oauth ActiveNeos-package[Authentication & Authorization](/categories/authentication) sjs/neos-mcp-oauth ================== OAuth2 authentication for Neos MCP server - enables self-service OAuth client creation and authorization v1.0.0(1mo ago)11AGPL-3.0-or-laterPHP Since Jun 11Pushed 1mo agoCompare [ Source](https://github.com/sjsone/SJS.Neos.MCP.OAuth)[ Packagist](https://packagist.org/packages/sjs/neos-mcp-oauth)[ RSS](/packages/sjs-neos-mcp-oauth/feed)WikiDiscussions main Synced 1w ago READMEChangelogDependencies (4)Versions (2)Used By (0) SJS.Neos.MCP.OAuth ================== [](#sjsneosmcpoauth) OAuth 2.0 authentication layer for the Neos MCP server. Enables MCP clients (Claude Desktop, VS Code, etc.) to authenticate against the Neos backend using the standard Authorization Code flow with PKCE. Built on [league/oauth2-server](https://oauth2.thephpleague.com/) using opaque tokens — no JWT signing key management required. --- How It Works ------------ [](#how-it-works) ``` MCP Client Neos CMS MCP Server │ │ │ │ 1. GET /.well-known/ │ │ │ oauth-authorization-server│ │ │ ──────────────────────────────> │ │ │ │ │ 2. POST /oauth/mcp/register │ │ │ (auto-register client) │ │ │ ──────────────────────────────> │ │ │ │ │ 3. GET /oauth/mcp/authorize │ │ │ (redirects to Neos login │ │ │ if not authenticated) │ │ │ ──────────────────────────────> │ │ │ │ │ 4. POST /oauth/mcp/token │ │ │ (exchange code → token) │ │ │ ──────────────────────────────> │ │ │ │ │ 5. POST /mcp Bearer │ │ │ ──────────────────────────────────────────────────────────>│ ``` When an unauthenticated user hits the authorize endpoint, they are redirected to the Neos login page. After login, an AOP aspect (`LoginRedirectAspect`) redirects them back to complete the OAuth flow seamlessly. --- Endpoints --------- [](#endpoints) ### RFC 8414 — Authorization Server Metadata [](#rfc-8414--authorization-server-metadata) RouteMethodDescription`/.well-known/oauth-authorization-server`GETServer metadata discovery (endpoints, scopes, grant types)### OAuth 2.0 Endpoints [](#oauth-20-endpoints) RouteMethodDescription`/oauth/mcp/authorize`GET, POSTAuthorization endpoint (Authorization Code flow)`/oauth/mcp/token`POSTToken endpoint (exchange code for access/refresh tokens)`/oauth/mcp/register`POSTDynamic Client Registration (RFC 7591)All OAuth endpoints are accessible to `Neos.Flow:Everybody` — authentication happens at the authorize step via the Neos backend login. --- Configuration ------------- [](#configuration) ### Quick Setup [](#quick-setup) ``` # Generate an encryption key ./flow oauth:generateEncryptionKey # Add the output to your Settings.SJS.Flow.MCP.yaml ``` --- Token Format ------------ [](#token-format) The server uses **opaque tokens** (random strings stored in the database) rather than JWTs. This means: - No RSA key pair management — only the encryption key is needed - Tokens are validated by database lookup via `OpaqueTokenValidator` - Revocation is instant (delete from DB) — no token expiry race conditions - `OAuthConnectionProvider` resolves opaque tokens to MCP `Connection` objects for the MCP server ### Token Lifecycle [](#token-lifecycle) 1. Client authenticates via Authorization Code flow → receives `access_token` + `refresh_token` 2. `access_token` is used as `Authorization: Bearer ` on MCP requests 3. Expired access tokens can be refreshed via the refresh token grant 4. Tokens can be revoked through the backend module --- Connection Provider Chain ------------------------- [](#connection-provider-chain) This package replaces the default `ConnectionProviderInterface` with `ChainedConnectionProvider` (configured in `Objects.yaml`): ``` Incoming Bearer token → ChainedConnectionProvider → OAuthConnectionProvider (tries opaque OAuth token lookup first) → PersistentConnectionProvider (falls back to static token config) ``` This means existing static-token configurations continue to work alongside OAuth. --- Backend Modules --------------- [](#backend-modules) ### MCP OAuth Manager (`/neos/administration/mcp/oauthClientModule`) [](#mcp-oauth-manager-neosadministrationmcpoauthclientmodule) Admin module for managing all OAuth clients across all users. Requires `Neos.Neos:Administrator` role. ### OAuth Clients (`/neos/mcp/oauthClients`) [](#oauth-clients-neosmcpoauthclients) User-facing module where editors can manage their own OAuth client applications. Requires `Neos.Neos:AbstractEditor` role. Both modules support: create, edit, delete clients, regenerate secrets, list active tokens, and revoke tokens. --- CLI Commands ------------ [](#cli-commands) CommandDescription`./flow oauth:generateEncryptionKey`Generate a hex-encoded 32-byte encryption key--- Related ------- [](#related) - **[SJS.Neos.MCP](https://github.com/sjsone/SJS.Neos.MCP)** — Core MCP server (provides the `/mcp` endpoint this package protects) - **[SJS.Flow.MCP](https://github.com/sjsone/SJS.Flow.MCP)** — Flow framework MCP abstractions (server, tools, FeatureSets) ### Health Score 35 — LowBetter than 77% of packages Maintenance90 Actively maintained with recent releases Popularity4 Limited adoption so far Community6 Small or concentrated contributor base Maturity33 Early-stage or recently created project Bus Factor1 Top contributor holds 100% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Unknown Total 1 Last Release 45d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/2229ac36a196d4d72de5bd2d2a773f5149a6751001465d6044bd7f90f2c5f73d?d=identicon)[sjsone](/maintainers/sjsone) --- Top Contributors [![sjsone](https://avatars.githubusercontent.com/u/87149727?v=4)](https://github.com/sjsone "sjsone (3 commits)") ### Embed Badge ![Health badge](/badges/sjs-neos-mcp-oauth/health.svg) ``` [![Health](https://phpackages.com/badges/sjs-neos-mcp-oauth/health.svg)](https://phpackages.com/packages/sjs-neos-mcp-oauth) ``` ### Alternatives [jeremy379/laravel-openid-connect OpenID Connect support to the PHP League's OAuth2 Server. Compatible with Laravel Passport. 61437.0k9](/packages/jeremy379-laravel-openid-connect)[steverhoades/oauth2-openid-connect-server An OpenID Connect Server that sites on The PHP League's OAuth2 Server 2138.8M18](/packages/steverhoades-oauth2-openid-connect-server)[league/oauth2-server-bundle Symfony bundle . 2375.3M8](/packages/league-oauth2-server-bundle)[shopware/core Shopware platform is the core for all Shopware ecommerce products. 585.6M604](/packages/shopware-core)[trikoder/oauth2-bundle Symfony bundle which provides OAuth 2.0 authorization/resource server capabilities. 2511.8M](/packages/trikoder-oauth2-bundle)[simplesamlphp/simplesamlphp-module-oidc A SimpleSAMLphp module adding support for the OpenID Connect protocol 5018.2k1](/packages/simplesamlphp-simplesamlphp-module-oidc) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)