Startup issues - docker image and authentication

[jeffdyke]

This looks like a great project, i was writing something that effectively did the same, when i ran into this project.

• Docker: creates /data/secret as a directory which stops the server from starting
  • I added a Dockerfile that simply runs
    RUN rm -rfv /data && mkdir /data && touch /data/secret
• Password: I have a password set, yet, the application won't prompt for it, there is no mention of a username if basic auth is expected. I want to use this for Google. Setting up the mcp-proxy returns simply 401 Unauthorized

I would love to help with some rough edges as i work through testing this. These first two errors, while not significant, they put up a barrier, so if i can help, i would be happy to.

[hrntknr]

creates /data/secret as a directory which stops the server from starting

DATA_PATH/secret is a reserved path. Please rename your file. (It is automatically generated.)
If you wish to explicitly specify an internal secret, write a random 32-byte value to this file.

https://github.com/sigbit/mcp-auth-proxy/blob/main/pkg/utils/keys.go#L17

I have a password set, yet, the application won't prompt for it

Please provide more detailed information about the MCP client.

If you are accessing the MCP Endpoint via a web browser, this is the expected result.
The MCP client reads the server's information and initiates authentication through the appropriate flow, so it cannot be accessed from a web browser.

[jeffdyke]

Thank you for the response. I am attempting to put mcp-proxy in front of a mariadb-mcp server, to be called by Claude.ai, web client. I have a compose file similar to

version: "3.8"
services:
  mcp-auth-proxy:
    image: ghcr.io/sigbit/mcp-auth-proxy:latest
    ports:
      - "8080:80"
    environment:
      - EXTERNAL_URL=https://auth.testing.company.com
      - NO_AUTO_TLS=true
      - GOOGLE_CLIENT_ID=A-REAL-CLIENT-ID
      - GOOGLE_CLIENT_SECRET=A-REAL-SECRET
      - GOOGLE_ALLOWED_USERS=me@company.com
      - GOOGLE_ALLOWED_WORKSPACES=company.com
      - MODE=debug
    command: ["http://10.1.1.230:9001/mcp"]
    restart: unless-stopped

The mcp-proxy is forwarded traffic from nginx/haproxy which have the certificates.
I'm not positive of the command portion, yet omitting /mcp provides a error, so hoping this is close.

When running a test from claude.ai, i see the logs

2025-10-24T15:25:07.042Z	INFO	zap@v1.1.5/zap.go:125	/mcp	{"status": 401, "method": "HEAD", "path": "/mcp", "query": "", "ip": "10.1.1.230", "user-agent": "python-httpx/0.27.2", "latency": "32.415µs", "time": "2025-10-24T15:25:07Z"}
2025-10-24T15:25:11.996Z	INFO	zap@v1.1.5/zap.go:125	/mcp	{"status": 401, "method": "POST", "path": "/mcp", "query": "", "ip": "10.1.1.230", "user-agent": "Claude-User", "latency": "54.338µs", "time": "2025-10-24T15:25:11Z"}
2025-10-24T15:25:12.187Z	INFO	zap@v1.1.5/zap.go:125	/mcp	{"status": 401, "method": "GET", "path": "/mcp", "query": "", "ip": "10.1.1.230", "user-agent": "Claude-User", "latency": "45.05µs", "time": "2025-10-24T15:25:12Z"}

Appreciate any guidance.

[hrntknr]

Thank you for the detailed logs.
Upon review, I'm concerned that the logs lack entries for paths starting with .well-known, etc.
The mcp client needs to verify the authentication configuration using paths like .well-known/oauth-protected-resource.

Is the .well-known directory being proxied by nginx/haproxy?

Please verify that requests to respond correctly.:

• https://auth.testing.company.com/.well-known/oauth-protected-resource
• https://auth.testing.company.com/.well-known/oauth-authorization-server