Authentication¶
The Kelvin MCP server uses OAuth 2.1 and OIDC via Keycloak for all authentication. This is the same identity provider used by the rest of the Kelvin Platform.
How authentication works¶
Every request to the /mcp endpoint requires a valid bearer token. The server validates the token against Keycloak, checking:
- Issuer and audience claims
- Token signature
- A required Kelvin permission role
If validation fails, the request is rejected before it reaches the Kelvin API.
Automatic sign-in flow¶
The server publishes OAuth discovery metadata at two well-known endpoints:
/.well-known/oauth-protected-resource/.well-known/oauth-authorization-server
A compliant MCP client reads this metadata automatically and launches the Keycloak sign-in flow in a browser window on first connection. After signing in, the client manages token refresh without further manual steps.
Dynamic client registration¶
The server supports dynamic client registration. It returns a pre-configured public client so standard MCP clients can complete the OAuth flow with Keycloak without requiring a manually registered application.
Permissions¶
Note
The MCP server grants no new permissions. It forwards your bearer token and the Kelvin API enforces your existing permissions. The assistant can only do what you can do.
All access control is determined by your Kelvin user account. If your account cannot perform an action through the Kelvin UI or API directly, it cannot perform that action through the MCP server either.