OAuth 2.1 · OpenID Connect · MCP
The authorization server for the agent era.
FoxAuth is built on OAuth-server.ts, a source-available OAuth 2.1 / OpenID Connect server you run yourself. It ships with a built-in admin console, banking-grade profiles, and administration over MCP for AI agents.
It is for engineering teams who need identity inside their own infrastructure, and for anyone building agents that must administer it. Self-hosting is free and complete under the Functional Source License (FSL-1.1-ALv2), which becomes Apache 2.0 two years after each release.
22 specificationsBun + ElysiaFSL-1.1-ALv2
curl -O https://raw.githubusercontent.com/RedFox-Soft/OAuth-server.ts/main/docker-compose.yml
docker compose up
# open http://localhost:3000/adminWhat those two commands give you
- A database started and provisioned, with indexes and a signing key
- Admin console at /admin, with first-run setup for the super administrator
- Discovery at /.well-known/openid-configuration, reflecting the flags you set
- No sign-up no tenant, no API key, no phone call
Already running something else? We keep dated, sourced comparisons with Auth0, authentik, Keycloak, Ory Hydra and Zitadel, each listing the pages we read and the date we read them.
The console
Everything an operator needs, without a second product.
Projects, clients, user buckets, end-users, upstream providers, settings, SMTP, signing keys and an append-only audit trail, all in one console that you sign into through the server's own OpenID Connect flow. The same API is what an AI agent uses over MCP.
Who runs it
Three teams, one server.
The same binary, the same admin API. What changes, for the most part, is which flags you set.
For TypeScript teams
Bun and Elysia, one command to run, and 31 named seams you replace with your own function instead of forking.
- Runs on Bun; the HTTP layer is Elysia
- PostgreSQL or MongoDB in production, in-memory for tests
- 31 override seams, resolved at call time
See all features
For AI-agent builders
Protect your own MCP server with it, and let an agent administer the instance through the console’s own code path. There is no separate privileged API to keep in step.
- Declare your MCP server; get audience-bound tokens (RFC 8707)
- Client ID Metadata Documents, so an agent host needs no setup
- 65 MCP tools for administration, off until you set mcp.enabled
See all features
For regulated industries
The banking-grade profiles are implemented today, and none of them is waiting on a roadmap. Turn on the flag your regulator asks for.
- FAPI, DPoP, PAR, mTLS, CIBA, RAR, JARM
- Append-only admin audit trail
- Per-identity brute-force throttle
See all features
Quick start
A token in five minutes.
No sign-up, no tenant, no API key. Three short pages, and you should have a token in your terminal.
Run the server
Docker Compose starts the database, provisions the schema and seeds the admin console. One file per datastore; pick either.
Register a client
Create a project and its first OAuth client in the console, with exact redirect URIs.
Get a token
Walk the Authorization Code flow with PKCE and read the claims out of the ID token.
Standards
Twenty-two specifications, implemented.
Every entry below is code in the repository, with tests. Each links to the spec it implements; the Reference names the flag that governs it.
An OAuth server for MCP
Protect your MCP server, and let an agent operate this one.
Declare your own MCP server as a protected resource of a project and this server mints tokens whose audience is exactly that resource. No code here, no restart. An agent host discovers it, signs your users in, and comes back with a token your MCP server verifies against the published keys without asking anything. Aclient_id that is an HTTPS URL is accepted as a client identity document, so a host with nothing to configure still connects.
Turn on mcp.enabled and the management API is served to an AI agent at POST /mcp as an OAuth 2.1 protected resource. Each of the 65 tools rebuilds the request the console would have sent and runs the console's own permission checks, validation and audit write, so no privileged back door can drift away from the console.
Destructive and instance-wide operations need two calls: the first returns a confirmation token, the second carries it. It is off by default.
agent → settings_update { "deviceFlow.enabled": false }
server ← Nothing has been changed. Change server settings. The merged
configuration is validated first …
Target: settings_update
To proceed, call settings_update again with
confirmationToken="<token from the first call>".
It is valid once, until 2026-09-03T14:12:04.000Z.
agent → settings_update { "deviceFlow.enabled": false,
"confirmationToken": "<token from the first call>" }
server ← { "appliedKeys": ["deviceFlow.enabled"],
"pendingRestartKeys": [], … }
Audit: actor agent:ops-bot, action settings.update.Licensing
Source-available, honestly.
The code is public and you may read, modify, self-host and redistribute it — for anything except offering it to others as a competing hosted service. Two years after each version ships, that version converts to the Apache License 2.0.
Start
Run it yourself this afternoon.
Self-hosting is free and complete. The managed instance is next.