# Clone your forked repository
git clone https://github.com/YOUR_USERNAME/mcp-auth-demo.git
cd mcp-auth-demo

# Install dependencies
pnpm install

# Note: Replace YOUR_USERNAME with your actual GitHub username
# Original repository: https://github.com/gocallum/mcp-auth-demo.git

# Start the development server
pnpm dev

# The app will be available at http://localhost:3000
# Test the authentication by visiting the app and signing in

# Prerequisites Check for Rolldice MCP Server

## Required: Working Rolldice MCP Server
Before adding authentication, ensure your rolldice MCP server is working:

### Local Development
```bash
# Navigate to your rolldice project
cd path/to/your/rolldice-mcp

# Install dependencies
pnpm install

# Start development server
pnpm dev

# Test locally at http://localhost:3000
```

### Production Deployment
- Deployed rolldice server on Vercel
- MCP endpoints accessible via HTTPS
- Basic dice rolling functionality working

## Required: VS Code Insider with MCP
You must have VS Code Insider configured with MCP extension:

### MCP Extension Setup
- VS Code Insider installed (not regular VS Code)
- MCP extension installed and enabled
- GitHub MCP server configured in .vscode/mcp.json
- Successfully tested MCP functionality with GitHub integration

### Test Your MCP Setup
Try these commands in VS Code Insider:
- "create a new repository"  
- "list my repositories"
- "create a new issue"

If these don't work, complete the Developer Productivity workshop first:
**Reference**: /developer-productivity workshop has full MCP setup instructions

## Test Commands for Rolldice
Verify these work in your MCP clients:
- "roll a d6"
- "roll 2d10"  
- "roll a d20 with advantage"

⚠️ **Important**: If your rolldice server or VS Code MCP setup isn't working, complete the prerequisite workshops first.

# Securing Your Rolldice MCP Server with OAuth 2.1

## Overview
This guide shows how to add OAuth 2.1 authentication to your existing rolldice MCP server using patterns from the [mcp-auth-demo](https://github.com/gocallum/mcp-auth-demo.git) project.

## Prerequisites
- Working rolldice MCP server (locally tested)
- Deployed rolldice MCP server on Vercel
- Google OAuth credentials from previous steps
- Familiarity with the mcp-auth-demo authentication patterns

## Step 1: Study the Authentication Demo
```bash
# Clone the authentication demo for reference
git clone https://github.com/gocallum/mcp-auth-demo.git
cd mcp-auth-demo
```

## Step 2: Copy Authentication Patterns
Apply these key authentication patterns from the demo to your rolldice server:

### 1. Authentication Utilities (lib/auth.ts)
- Google OAuth token verification
- User session management
- Token validation middleware

### 2. Protected MCP Handler (app/api/mcp/route.ts)
- Wrap existing rolldice functionality with authentication
- Maintain dice rolling logic while adding security
- Handle authentication errors gracefully

### 3. OAuth Endpoints
- Authorization server metadata (/.well-known/oauth-authorization-server)
- Protected resource metadata (/.well-known/oauth-protected-resource)
- Authentication callback handlers

## Step 3: Environment Variables
Add these environment variables to both local and production environments:

```env
# Google OAuth Configuration
GOOGLE_CLIENT_ID=your-google-client-id
GOOGLE_CLIENT_SECRET=your-google-client-secret
```

## Step 4: Test Authentication Flow
1. Test locally with http://localhost:3000
2. Verify OAuth login redirects work
3. Test dice rolling after authentication
4. Deploy to production with same environment variables
5. Update MCP client configurations

## Step 5: MCP Client Configuration
Update your MCP clients to use the authenticated server:

### VS Code MCP Extension
```json
{
  "servers": {
    "secure-rolldice": {
      "type": "http",
      "url": "https://your-secure-rolldice.vercel.app/api/mcp"
    }
  }
}
```

### Claude Desktop
```json
{
  "mcpServers": {
    "secure-rolldice": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://your-secure-rolldice.vercel.app/api/mcp"
      ]
    }
  }
}
```

## Success Criteria
- [ ] OAuth login prompt appears when accessing rolldice tools
- [ ] Google authentication completes successfully
- [ ] Dice rolling works after authentication
- [ ] Unauthenticated requests are properly rejected
- [ ] Both VS Code MCP extension and Claude Desktop work

## Troubleshooting
- Verify Google OAuth redirect URIs include your production domain
- Check environment variables are set in Vercel
- Ensure discovery endpoints return proper OAuth metadata
- Test authentication flow in incognito/private browser window

# Clone your existing rolldice project from Builder's Toolkit
git clone https://github.com/YOUR_USERNAME/rolldice-mcp.git
cd rolldice-mcp

# Or navigate to your existing project
cd path/to/your/rolldice-mcp

# Install OAuth 2.1 authentication dependencies
pnpm add google-auth-library
pnpm add mcp-handler

# Install additional Next.js dependencies if needed
pnpm add next @types/node typescript

import { OAuth2Client } from "google-auth-library";

const client = new OAuth2Client(process.env.GOOGLE_CLIENT_ID);

export async function verifyGoogleToken(token: string) {
  try {
    const ticket = await client.verifyIdToken({
      idToken: token,
      audience: process.env.GOOGLE_CLIENT_ID,
    });
    return ticket.getPayload();
  } catch (error) {
    console.error("Token verification failed:", error);
    return null;
  }
}

import { createMcpHandler } from "mcp-handler";
import { verifyGoogleToken } from "@/lib/auth";
import { rollDice, rollMultipleDice } from "@/lib/dice";

// Authenticated MCP handler for rolldice
const handler = createMcpHandler({
  async authenticate(authInfo) {
    if (!authInfo?.token) {
      throw new Error("Authentication required");
    }
    const payload = await verifyGoogleToken(authInfo.token);
    if (!payload) {
      throw new Error("Invalid authentication");
    }
    return { user: payload.email };
  },
  tools: [
    // Your existing rolldice tools with authentication
  ],
});

export { handler as GET, handler as POST };

# Create these OAuth 2.1 discovery endpoints:

# app/api/auth/authorize/route.ts - OAuth authorization endpoint
# app/api/auth/token/route.ts - Token exchange endpoint
# app/api/auth/callback/route.ts - OAuth callback handler
# app/.well-known/oauth-authorization-server/route.ts - Discovery
# app/.well-known/oauth-protected-resource/route.ts - Resource metadata

# Google OAuth 2.1 Configuration
GOOGLE_CLIENT_ID=your_google_client_id_here.apps.googleusercontent.com
GOOGLE_CLIENT_SECRET=your_google_client_secret_here

pnpm dev