# AuthPlane > Open-source OAuth 2.1 authorization server purpose-built for the Model Context Protocol (MCP). Self-hosted, spec-compliant, deployed as a single Go binary on your own infrastructure. AuthPlane gives MCP server operators production-grade OAuth 2.1 without sending tokens through someone else's cloud. It ships as one Go binary, federates to your existing identity provider (Google, Okta, Entra ID, Auth0, or any OIDC-compliant provider), and supports agent-to-agent delegation chains, DPoP proof-of-possession, and an upstream provider Token Vault — all behind a built-in admin UI. The server is licensed AGPL-3.0. SDKs for Python, TypeScript, and Go are released today; Rust, C#, and Java are on the roadmap. Validated end-to-end against Claude Desktop and MCP Inspector. Current version: v0.1.x. ## Core pages - [Home](https://authplane.ai/): product narrative — the problem agentic auth solves, the AuthPlane solution, how it sits in your stack, quickstart, standards catalogue, and FAQ. - [Product](https://authplane.ai/product/): the five capabilities behind AuthPlane — Token Vault, DPoP, Token Exchange, Agent Identity, Cross-App Access — plus the three deploy paths and the Open Source / EE / Cloud roadmap. - [Security disclosure](https://authplane.ai/security/): responsible disclosure policy. Machine-readable metadata at `/.well-known/security.txt` (RFC 9116). - [Privacy Policy](https://authplane.ai/legal/privacy/): GDPR-compliant policy covering Cloudflare Web Analytics (cookieless) and Google Analytics 4 (consent-based). - [Terms](https://authplane.ai/legal/terms/): site terms of service. ## Docs The full documentation site is at [docs.authplane.ai](https://docs.authplane.ai/) (separate Astro/Starlight project at `AuthPlaneLabs/docs`, served from its own subdomain). Structure: - [Quickstart](https://docs.authplane.ai/quickstart/): run the AuthPlane server in under 10 minutes with `docker run`, then wire your MCP server via the SDK. Python, TypeScript, and Go code samples for the same flow. - [Concepts](https://docs.authplane.ai/concepts/architecture/): the ideas you need to understand — architecture (alongside, not in front), Token Vault, delegation chains, DPoP, Cross-App Access, agent identity, PRM. - [SDKs](https://docs.authplane.ai/sdks/overview/): per-language reference pages (Python/TypeScript/Go) with the full option surface, DPoP wiring, token-exchange examples. - [Operate](https://docs.authplane.ai/operate/overview/): pick a deployment mode — standalone binary (systemd), Docker Compose (single host), Kubernetes via Helm chart at `oci://ghcr.io/authplane/charts/authplane` (production). Vault Transit, backup/upgrade/purge. - [Reference](https://docs.authplane.ai/reference/configuration/): configuration schema, public API, admin API, error catalog, metrics and CLI, RFC compliance matrix. - [Guides](https://docs.authplane.ai/guides/connect-mcp-client/): step-by-step recipes — enable DPoP, federate to an IdP, connect an MCP client, test with MCP Inspector, XAA policy, upstream connections, admin API, monitoring. - [Troubleshooting](https://docs.authplane.ai/troubleshooting/faq/): common errors, debugging checklist, FAQ, getting help. ## Blog Long-form posts at [/blog](https://authplane.ai/blog/) covering MCP authorization, the OAuth 2.1 spec, and field comparisons. Each post is also available as raw Markdown at `/blog/.md`. RSS feed at [/blog/rss.xml](https://authplane.ai/blog/rss.xml). Currently published: - [Cross-App Access: Why Enterprise MCP Needs IdP-Mediated Authorization](https://authplane.ai/blog/cross-app-access-enterprise-mcp-authorization/) — how ID-JAG (RFC-track) inserts the IdP into every agent-to-tool connection. - [Reading RFC 9728: Protected Resource Metadata](https://authplane.ai/blog/reading-rfc-9728-protected-resource-metadata/) — the discovery document that lets MCP clients find their AS. - [What We Saw When Teams Shipped MCP Without Auth](https://authplane.ai/blog/what-happens-without-mcp-auth/) — four observed attack patterns and the mitigation each maps to. - [OAuth 2.1 + PKCE Is the Only Right Way to Secure MCP](https://authplane.ai/blog/why-mcp-needs-oauth-21-pkce/) — why the MCP Authorization spec picked OAuth 2.1 over simpler token schemes. ## Events Time-boxed programmes, listed alongside the writing at [/blog](https://authplane.ai/blog/). Entries here are removed once they close. - [AuthPlane × Skybridge Speedrun Challenge](https://authplane.ai/challenge/) — August 17–31, 2026. Build an MCP App with Skybridge (by Alpic), secure it with AuthPlane, record it, win $500. One winner, announced September 7, 2026. Full official rules on the page; also available as raw Markdown at `/challenge.md`. ## Standards implemented AuthPlane implements the MCP Authorization specification (2025-11-25) and 16 OAuth-family RFCs plus the CIMD IETF draft. Full compliance matrix at [docs.authplane.ai/reference/rfc-compliance](https://docs.authplane.ai/reference/rfc-compliance/). - OAuth 2.1 (core, `draft-ietf-oauth-v2-1`) - PKCE — RFC 7636 (mandatory S256) - Client Credentials — RFC 6749 §4.4 - JSON Web Key — RFC 7517 - JWT Bearer — RFC 7523 - Dynamic Client Registration — RFC 7591 - Token Introspection — RFC 7662 - Token Revocation — RFC 7009 - OAuth Authorization Server Metadata — RFC 8414 - Token Exchange — RFC 8693 (used for agent delegation) - Resource Indicators — RFC 8707 - JWT Access Tokens — RFC 9068 - DPoP — RFC 9449 - Problem Details for HTTP APIs — RFC 9457 - OAuth 2.0 Security BCP — RFC 9700 - Protected Resource Metadata — RFC 9728 - Client ID Metadata Document (CIMD) — IETF draft ## Public repos - [authplane/authserver](https://github.com/authplane/authserver) — the Go server (AGPL-3.0). Image published on Docker Hub as `authplane/authserver:latest`. - [authplane/python-sdk](https://github.com/authplane/python-sdk) — `authplane`, `authplane-mcp` (official MCP SDK), `authplane-fastmcp` (PrefectHQ) on PyPI. - [authplane/ts-sdk](https://github.com/authplane/ts-sdk) — `@authplane/sdk`, `@authplane/mcp`, `@authplane/fastmcp`, `@authplane/hono`, `@authplane/nestjs` on npm. - [authplane/go-sdk](https://github.com/authplane/go-sdk) — `authplanemcp` (official MCP SDK), `mark3labs` (mark3labs/mcp-go), generic `net/http`, and `core` primitives. - [authplane/conformance](https://github.com/authplane/conformance) — vendor-neutral OAuth 2.1 / RFC 9728 / MCP authorization conformance tests. ## Contact - Security disclosures: [security@authplane.ai](mailto:security@authplane.ai) or [GitHub Private Vulnerability Reporting](https://github.com/authplane/authserver/security/advisories/new). Policy at [/security](https://authplane.ai/security/). - Product and enterprise inquiries: [hello@authplane.ai](mailto:hello@authplane.ai). - Product issues and feature requests: file in the relevant GitHub repo above.