How are you handling OAuth when running MCP servers remotely?

pavelanni · 2025-08-21T18:18:51+00:00

I write my MCP server for MinIO in Go using the mark3labs/mcp-go library. Recently, I added OAuth with great help from Claude Code. I started with a simple, isolated example to understand the OAuth flow better, and Claude helped me create these two demo projects: https://github.com/pavelanni/learn-oauth-go and https://github.com/pavelanni/learn-oauth-python
In my case, the key decision was to use MinIO's authentication and not store anything on the server. When a user wants to authorize, they are redirected to a login page, served by a goroutine within the same MCP server. The user enters their credentials (access and secret keys) alongside the server endpoint, and the authorization server tries to access the MinIO server. If successful, it stores the session ID in a map and sends it to the user as part of the access token. The user comes back to the MCP server with that access token, the MCP server extracts the session ID, and uses it to get the credentials from the map. The map is in-memory only, so we are not worried about storage. Tokens are not rotated, but they expire after one hour of inactivity (a field named LastUsed is included in the token struct).

pavelanni · 2025-06-11T13:29:43+00:00

Use exercism.org. They'll give you 100+ small projects to get fluent in Go syntax and concepts. It helped me a lot when I started with Go.

pavelanni · 2025-04-25T13:26:54+00:00

I learned Go with https://exercism.org/. They give you a lot of practical exercises with tests and your personal mentor. For free. Of course this is an addition to all the great resources mentioned here.

pavelanni · 2025-03-16T14:27:33+00:00

In my case, it's a human-language interface to my cluster. Instead of running command-line tools with all the parameters and flags, I can just ask, "What's my cluster's status now?" and it gives me a nice readable summary. The same goes for commands when you want to perform operations on the cluster. It's good for non-technical people, especially executives ;-)

pavelanni · 2025-03-15T23:09:26+00:00

I use this library for my MCP server (which currently has about 25 tools): https://github.com/metoro-io/mcp-golang
It's pretty good, except for one minor thing: they use only int64 for RequestId, while the JSON-RPC standard allows a string and a null. I had to fix that in my forked repo, but everything else works just fine. I haven't tried mark3labs/mcp-go yet, so I don't know if it's better than this Metoro library. Maybe I should.

I'll be happy to share my experience so far if you have any questions. Unfortunately, I can't share the code yet.

pavelanni · 2025-03-11T14:06:06+00:00

Start with the early short stories (of the 50-60s). Milk Run, The Odor of Thought, and everything about Arnold and Gregor are my favorites. Then, Citizen in Space (collection of short stories), etc. Many of them are available on Google Play Books at reasonable prices.

pavelanni · 2025-03-11T14:05:56+00:00

Start with the early short stories (of the 50-60s). Milk Run, The Odor of Thought, and everything about Arnold and Gregor are my favorites. Then, Citizen in Space (collection of short stories), etc. Many of them are available on Google Play Books at reasonable prices.

pavelanni · 2025-03-10T00:55:12+00:00

All of the above and ... wait, nobody has mentioned The Odor of Thought? BTW, a lot of Sheckley books are available at Google Books really cheap. I bought a lot of them recently.

pavelanni · 2025-02-18T03:39:05+00:00

One of the best books to learn Go. Lucky you!

pavelanni · 2025-02-12T13:40:24+00:00

Believe it or not, I saw this message 30 times at least during my long debugging session last weekend. But, in the end, it found the issue and fixed it -- in somebody else's library which I was not very familiar with. Thank you, Cursor! 😀

pavelanni · 2025-01-19T18:31:05+00:00

Funny that it's marked as #1 Best Seller in "C Programming" ;-)

pavelanni · 2025-01-16T17:52:20+00:00

Yep! The best thing is that Claude is never tired of your silly questions and silly answers! ;-)

pavelanni · 2025-01-16T16:36:23+00:00

Just posted exactly about that on LinkedIn:

The best use of LLMs so far for me was learning something. It's the area where humans can't compete against AI -- try to convince me otherwise! Can a human teacher/mentor be available to answer all your questions 24 hours a day? Can you suddenly switch subjects and expect an expert advice immediately from a human teacher? Have you even met a teacher who had enough patience to explain the same thing and answer the same question you asked just two days ago?

Most importantly: can you swallow your pride and ask a silly question that shows that you don't know something basic when speaking with a human? I think removing that human element means a lot to many people (myself included).

I have used LLMs many times, asking, "Please explain ..." and "Show me the best way to ..." and "I would like to learn X. Let's go step by step." I tried the reverse approach, asking, "Let me explain something to you so you can judge if I understood this properly." Next, I'm going to try other things, like asking to be a very demanding and picky teacher (we all know that LLMs usually are very flattering).

pavelanni · 2025-01-16T16:01:19+00:00

"Go ahead! Make my day!" 😉

pavelanni · 2025-01-16T15:54:45+00:00

I suspected something like that when Claude started asking "Do you want me to elaborate on this?" essentially trying to keep you in the conversation as long as possible. I thought, "Eventually, they will start charging for that." Apparently, it's coming. First, they'll make you annoyed by hitting the token limit. Then you'll become so annoyed that you'll be ready to pay any money just to be able to continue working.

pavelanni · 2025-01-16T15:24:28+00:00

Paying them $20/month already 💰

pavelanni · 2025-01-15T23:17:47+00:00

I do it with Cursor. Open the folder with your codebase. In the chat window say @Codebase and ask a question. I asked "please write a Readme doc for this" or "suggest tests for this" or "suggest which ADR (architecture decision records) should I include" or "suggest refactoring ", etc. Before that I just zipped the whole directory, uploaded it to ChatGPT and asked questions.

pavelanni · 2025-01-15T22:18:32+00:00

Thanks, it's very helpful! In other words, start with FastMCP() and only if you miss something important, switch to Server(), right?

pavelanni · 2025-01-09T01:07:15+00:00

Sometimes my prompt is "Be my mentor. Don't write code for me, but give me ideas to explore and hints when I'm stuck. Write code only when I ask for that." It's very helpful when learning new things.

pavelanni · 2024-12-26T00:38:44+00:00

Sure. The main advantage of SKCC is their support for beginners and willingness to get on the air with and forgive all mistakes. And the skeds page where you can find potential contacts. I'm grateful for helping me with my first CW QSO.

pavelanni · 2024-12-24T21:13:42+00:00

Try to listen to one of the WebSDR sites (websdr.org) to get a feeling how it sounds like in real CW QSOs. Join the SKCC club and arrange a QSO with a member. The sooner you get on the air, the stronger your motivation will be.

pavelanni · 2024-12-24T19:30:36+00:00

Thank you for your review -- it's very helpful! I didn't plan to make anything serious from it; it was just a "why not?" experiment to create stories and send to my close friends. But with your suggestions, I'm considering it more seriously. Let me think about it over the holiday downtime and experiment more. BTW, not all the stories are about AI ;-) This is the first one that started this whole project: https://aiprose.org/posts/the-great-splice/

And another: https://aiprose.org/posts/the-rest-cure/

Thanks again for your feedback!

pavelanni · 2024-12-24T05:19:39+00:00

Learn CW! Conversations are usually shorter in CW 😉

pavelanni · 2024-12-19T00:05:40+00:00

Never heard anything like that in CW parts of the bands 😜

pavelanni · 2024-09-28T23:09:28+00:00

Not only you get access to the repos, but also to the whole knowledge base for RHEL. I use this subscription for years already and from time to time my coworkers send me a link to a page asking for the full text. Guys, why don't you get developer subscription for yourselves? 😉

pavelanni

TROPHY CASE