--- title: "FoxAuth — the authorization server for the agent era" description: "A source-available OAuth 2.1 and OpenID Connect server you run yourself, with a built-in admin console and administration over MCP for AI agents." canonical: "https://foxauth.dev/" lastmod: "2026-09-14T22:23:57+03:00" --- OAuth 2.1 · OpenID Connect · MCP The authorization server for the agent era. FoxAuth is built on OAuth-server.ts, a source-available OAuth 2.1 / OpenID Connect server you run yourself. It ships with a built-in admin console, banking-grade profiles, and administration over MCP for AI agents. It is for engineering teams who need identity inside their own infrastructure, and for anyone building agents that must administer it. Self-hosting is free and complete under the Functional Source License (FSL-1.1-ALv2), which becomes Apache 2.0 two years after each release. Get startedView on GitHub 22 specificationsBun + ElysiaFSL-1.1-ALv2 Two commands and a browser tab curl -O https://raw.githubusercontent.com/RedFox-Soft/OAuth-server.ts/main/docker-compose.yml docker compose up # open http://localhost:3000/admin What those two commands give you →A database started and provisioned, with indexes and a signing key →Admin console at /admin, with first-run setup for the super administrator →Discovery at /.well-known/openid-configuration, reflecting the flags you set →No sign-up no tenant, no API key, no phone call Already running something else? We keep dated, sourced comparisons with Auth0, authentik, Keycloak, Ory Hydra and Zitadel, each listing the pages we read and the date we read them. The console Everything an operator needs, without a second product. Projects, clients, user buckets, end-users, upstream providers, settings, SMTP, signing keys and an append-only audit trail, all in one console that you sign into through the server's own OpenID Connect flow. The same API is what an AI agent uses over MCP. A project's clients in the built-in console. Every change here is an audit entry. Who runs it Three teams, one server. The same binary, the same admin API. What changes, for the most part, is which flags you set. For TypeScript teams Bun and Elysia, one command to run, and 31 named seams you replace with your own function instead of forking. →Runs on Bun; the HTTP layer is Elysia →PostgreSQL or MongoDB in production, in-memory for tests →31 override seams, resolved at call time See all features For AI-agent builders Protect your own MCP server with it, and let an agent administer the instance through the console’s own code path. There is no separate privileged API to keep in step. →Declare your MCP server; get audience-bound tokens (RFC 8707) →Client ID Metadata Documents, so an agent host needs no setup →65 MCP tools for administration, off until you set mcp.enabled See all features For regulated industries The banking-grade profiles are implemented today, and none of them is waiting on a roadmap. Turn on the flag your regulator asks for. →FAPI, DPoP, PAR, mTLS, CIBA, RAR, JARM →Append-only admin audit trail →Per-identity brute-force throttle See all features Quick start A token in five minutes. No sign-up, no tenant, no API key. Three short pages, and you should have a token in your terminal. 1 Run the server Docker Compose starts the database, provisions the schema and seeds the admin console. One file per datastore; pick either. 2 Register a client Create a project and its first OAuth client in the console, with exact redirect URIs. 3 Get a token Walk the Authorization Code flow with PKCE and read the claims out of the ID token. Standards Twenty-two specifications, implemented. Every entry below is code in the repository, with tests. Each links to the spec it implements; the Reference names the flag that governs it. OAuth 2.1 RFC 6749 RFC 7636 RFC 7519 RFC 7517 OIDC Core 1.0 OIDC Discovery 1.0 RFC 9207 RFC 8707 RFC 7009 RFC 7662 RFC 9701 RFC 9126 RFC 9449 RFC 7591 RFC 7592 RFC 8628 RFC 8705 RFC 9396 RFC 9728 CIBA JARM Endpoint reference An OAuth server for MCP Protect your MCP server, and let an agent operate this one. Declare your own MCP server as a protected resource of a project and this server mints tokens whose audience is exactly that resource. No code here, no restart. An agent host discovers it, signs your users in, and comes back with a token your MCP server verifies against the published keys without asking anything. Aclient_id that is an HTTPS URL is accepted as a client identity document, so a host with nothing to configure still connects. Turn on mcp.enabled and the management API is served to an AI agent at POST /mcp as an OAuth 2.1 protected resource. Each of the 65 tools rebuilds the request the console would have sent and runs the console's own permission checks, validation and audit write, so no privileged back door can drift away from the console. Destructive and instance-wide operations need two calls: the first returns a confirmation token, the second carries it. It is off by default. Protect your MCP serverAll 65 MCP tools agent → settings_update { "deviceFlow.enabled": false } server ← Nothing has been changed. Change server settings. The merged configuration is validated first … Target: settings_update To proceed, call settings_update again with confirmationToken="". It is valid once, until 2026-09-03T14:12:04.000Z. agent → settings_update { "deviceFlow.enabled": false, "confirmationToken": "" } server ← { "appliedKeys": ["deviceFlow.enabled"], "pendingRestartKeys": [], … } Audit: actor agent:ops-bot, action settings.update. Licensing Source-available, honestly. The code is public and you may read, modify, self-host and redistribute it — for anything except offering it to others as a competing hosted service. Two years after each version ships, that version converts to the Apache License 2.0. Read the license Start Run it yourself this afternoon. Self-hosting is free and complete. The managed instance is next. Get startedRead the docsJoin the cloud waitlist