From d5fccd00ff2f329a87c80d07eed7ea8f8c31151d Mon Sep 17 00:00:00 2001 From: benjdlambert Date: Tue, 16 Sep 2025 10:46:46 +0200 Subject: [PATCH] chore: add docs Signed-off-by: benjdlambert --- plugins/mcp-actions-backend/README.md | 23 +++++++++++++++++++++++ 1 file changed, 23 insertions(+) diff --git a/plugins/mcp-actions-backend/README.md b/plugins/mcp-actions-backend/README.md index c44bd7f0a6..3b0a01f525 100644 --- a/plugins/mcp-actions-backend/README.md +++ b/plugins/mcp-actions-backend/README.md @@ -103,6 +103,29 @@ node -p 'require("crypto").randomBytes(24).toString("base64")' Set the `MCP_TOKEN` environment variable with this token, and configure your MCP client to use it in the [Authorization header](#configuring-mcp-clients) +#### Experimental: Dynamic Client Registration + +> This is highly experimental, proceed with caution. + +You can configure both the `auth-backend` and install the `auth` frontend plugin in order to enable [Dynamic Client Registration](https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization#dynamic-client-registration) with MCP Clients. + +This means that there is no token required in your MCP settings, and a token will be given to a client that requests a token on your behalf. When adding the MCP server to an MCP client like Cursor or Claude, a popup that requires your approval will be opened in your Backstage instance, which is powered by the `auth` plugin. + +You will need to add the `@backstage/plugin-auth` package to your `app` `package.json`, and enable the following config in `app-config.yaml`: + +```yaml +auth: + experimentalDynamicClientRegistration: + # enable the feature + enabled: true + + # this is optional and will default to *, but you can limit the callback URLs which are valid for added security + allowedRedirectUriPatterns: + - cursor://* +``` + +> Note: the `@backstage/plugin-auth` package is only available currently in the new frontend system. + ## Configuring MCP Clients The MCP server supports both Server-Sent Events (SSE) and Streamable HTTP protocols.