Byward 让任意 MCP 服务器接入 OAuth 2.1 和 Entra ID

A sign-in gate for MCP servers. byward puts any MCP server, HTTP or stdio, behind OAuth 2.1 and your identity provider, with first-class Microsoft Entra ID support. One Go binary, configured by environment variables.

Latest release: v0.1.0. byward is pre-1.0 and has not had an independent security audit. Read the security posture before deploying it. main is ahead of the release; the docs for v0.1.0 are at its tag.

MCP client ──OAuth 2.1──▶ byward ──sign-in──▶ Entra ID (Claude, ChatGPT, │ VS Code, Cursor…) └──▶ MCP server (HTTP or stdio) never sees the client's or the IdP's token

MCP clients sign in with standard OAuth 2.1. byward is the authorization server: it signs the user in at Entra, shows its own consent page, and issues short-lived tokens of its own.

Clients connect without manual setup, through Client ID Metadata Documents (CIMD) or Dynamic Client Registration (DCR). Static clients cover anything else.

The MCP server needs no auth code. It never gets the client's token (no token passthrough).

Access is gated by Entra app roles and groups. Refresh tokens rotate with reuse detection, and operators can revoke a user or everyone.

Built to run: SQLite state, rate limits on the OAuth endpoints, a structured audit stream, Prometheus metrics, and byward doctor to check a deployment.

Verified clients

Signed in through byward against a real Entra tenant and called a tool:

The TypeScript, Python and Go MCP SDK clients and MCP Inspector run against byward in CI.

The Entra quickstart registers the app (or byward init entra prints the commands for you) and then runs byward in front of your MCP server:

docker run --rm -p 8080:8080 --user "$(id -u):$(id -g)"
-v "$PWD/byward-data:/var/lib/byward"
-v "$PWD/entra-client-secret:/run/secrets/entra-client-secret:ro"
-e BYWARD_PUBLIC_URL=https://mcp.example.com/mcp
-e BYWARD_UPSTREAM_URL=http://upstream.internal:3001/mcp
-e BYWARD_ENTRA_TENANT="$TENANT_ID"
-e BYWARD_ENTRA_CLIENT_ID="$APP_ID"
-e BYWARD_ENTRA_CLIENT_SECRET_FILE=/run/secrets/entra-client-secret
-e BYWARD_LISTEN=0.0.0.0:8080
ghcr.io/byward-dev/byward:latest

byward does not terminate TLS: put it behind your ingress or reverse proxy. Then work through the hardening checklist.

Images and archives are signed with cosign and carry build provenance; how to verify them: packaging.

How-to guides: stdio upstreams, access gate, CIMD, DCR, state and backups, all guides

Reference: settings, commands, observability

Design: scope and non-goals, all decisions, glossary, feature backlog, landscape research

Development

Requires mise. Then install the tools CI uses and run the checks:

mise install go golangci-lint go:golang.org/x/tools/cmd/goimports actionlint zizmor shellcheck go:github.com/google/go-licenses/v2 mise run check

Details, including why azure-cli is not needed here: CONTRIBUTING.md.

See CONTRIBUTING.md (including the AI-assistance policy) and the Code of Conduct. Report vulnerabilities privately: SECURITY.md.

MCP is a trademark of LF Projects, LLC. byward is an independent project.