SigID MCP discovery and server integration¶

MCP (Model Context Protocol) servers that access protected resources should require OAuth access tokens for tool calls.

Hosted SigID discovery server¶

Connect an MCP client using Streamable HTTP to https://auth.sigid.org/mcp. This public server needs no credentials and exposes only API descriptions and integration documentation. It cannot call protected APIs, manage accounts, read tenant data, or act on a user's behalf. It is available when public OpenAPI publication is enabled. The protocol version is 2025-11-25, with support for 2025-06-18 and 2025-03-26 clients.

All tools are read-only and use the same public contract and guides published through HTTP. No arbitrary URLs, file paths, tenant IDs, or credentials are accepted. API descriptions are not authorization to execute an operation.

curl https://auth.sigid.org/mcp \
  -H 'Content-Type: application/json' \
  -H 'Accept: application/json, text/event-stream' \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-11-25","capabilities":{},"clientInfo":{"name":"my-agent","version":"1.0"}}}'

After initialization send notifications/initialized, then tools/list or tools/call, with MCP-Protocol-Version: 2025-11-25 (or the negotiated version). Notifications receive HTTP 202 with an empty body. This stateless server uses JSON responses, does not issue session IDs, and returns 405 for standalone SSE GET and session DELETE requests. Request bodies are limited to 16 KiB and ten seconds. Invalid origins receive 403; unsupported protocol versions receive 400. Present browser origins must match the issuer or a configured first-party application origin; first-party preflights allow MCP-Protocol-Version. Native MCP clients can omit Origin. Omit Authorization on this anonymous endpoint: unprocessed credentials receive 401 invalid_token with a Bearer challenge. Explicit q=0 exclusions for JSON or SSE take precedence over Accept wildcards and receive 406. Self-hosted installations return OAuth URLs for their own configured issuer, matching their public OpenAPI document.

MCP specifies endpoint initialization and tool discovery; it does not define a universal /.well-known/mcp.json manifest. Discover this endpoint through SigID's llms.txt, OpenAPI, and this page.

Protecting your own MCP server¶

The remaining examples describe authenticated MCP servers built by integrators. Their OAuth audiences, tool scopes, and authorization policies are separate from SigID's public discovery tools.

Authentication Flow¶

For every tool request:

1. Parse bearer token from Authorization header
2. Validate issuer, audience, signature, expiry, tenant, and scope
3. Require subject type agent or delegated actor context
4. Map each tool to one or more scopes
5. Enforce resource-level tenant checks
6. Record high-impact tool calls in audit logs

Tool Policy Design¶

Example tool policy:

Tool: search_docs
Audience: https://mcp.example.com
Scope: tools:search
Allowed subject: agent or delegated agent

Tool: delete_project
Audience: https://mcp.example.com
Scope: projects:delete
Allowed subject: delegated agent only
Extra condition: human approval and fresh user session

Token Validation¶

Use Verify Tokens for backend claim checks.

Key claims to verify:

• iss: Must be your SigID issuer
• aud: Must match your MCP server
• sub: Acting agent's pairwise subject, including for delegated tokens
• subject_type: agent for the agent-only tools shown here
• act: Grantor context and delegation IDs when delegated
• scope: Must include required tool scopes

Example Implementation¶

This excerpt validates a bearer token for the single read-only search_docs tool. Resolve issuer, audience, tenant UUID, and the tool's configured scope with Integration Settings. Apply resource and delegation policy after token validation and before executing the tool.

import { validateAccessToken } from "@sigid/client";

const issuer = process.env.SIGID_ISSUER_URL?.trim();
const audience = process.env.SIGID_MCP_AUDIENCE?.trim();
const tenantId = process.env.SIGID_TENANT_ID?.trim();
const searchScope = process.env.SIGID_MCP_SEARCH_SCOPE?.trim();
if (!issuer || !audience || !tenantId || !searchScope) {
  throw new Error("Configure the MCP issuer, audience, tenant UUID, and search scope.");
}
const tokenOptions = {
  issuer,
  audience,
  tenantId,
  scopes: [searchScope],
  allowedSubjectTypes: ["agent"],
  allowDelegation: true,
};

export async function validateMcpRequest(authHeader: string) {
  const match = authHeader.trim().match(/^Bearer\s+(\S+)$/i);
  if (!match) {
    throw new Error("Bearer access token required");
  }

  const claims = await validateAccessToken(match[1], tokenOptions);

  return claims;
}

For a multi-tool server, select policy using the actual requested tool name and reject unknown tools before dispatch. The scope names below are illustrative; configure them in the relevant audience and grants before requesting tokens. allowDelegation: true permits delegated claims but does not enforce approval, chain policy, or current revocation. See Delegation Claims. For DPoP-bound tokens, use the SDK's DPoP validation options with shared replay checking; this bearer-only excerpt does not implement that transport.

Scope Mapping¶

Map tools to scopes:

The example uses validateAccessToken() from the public @sigid/client package. In a Next.js route handler, you can also use requireAccessToken() from @sigid/next to extract the bearer token from the request before running the same issuer, audience, tenant, scope, and subject checks.

Audit Logging¶

Log all tool calls with:

• Agent or user ID
• Tool name
• Parameters (redacted if sensitive)
• Timestamp
• Result

See Also¶

• Agent Authentication - Agent auth methods
• Delegation - Delegated access
• Verify Tokens - Backend token validation