Categories

AI Agents

How to secure your MCP server with Keycloak and OAuth in Docker

Keycloak 26.7.4 can act as the authorization server for an MCP server: it publishes its metadata, supports dynamic client registration and issues JWTs that FastMCP validates. It does not implement RFC 8707, so the token audience comes from a client scope and a mapper, and the MCP server must always check it.

How to Install

How to Install Authentik for Self-Hosted SSO

An Authentik Docker Compose install now needs only three containers: PostgreSQL, the server and the worker, since Redis stopped being mandatory in version 2025.10. Once running, it acts as your identity provider for single sign-on over OAuth2, OIDC, SAML and LDAP, and a reverse proxy such as Traefik can delegate authentication to it through forward auth.