Add OAuth to an MCP server that doesn't speak it
使うタイミング: Your MCP works great locally but the upstream has no auth; you need identity before exposing it.
前提条件
- Kubernetes cluster (or k3s/minikube for dev) — Jetski uses Metacontroller + CRDs
- PostgreSQL — Any reachable PG; Jetski creates its schema
フロー
-
Deploy JetskiApply Jetski's Helm chart to my cluster; confirm all pods ready.✓ コピーしました→ Gateway + dashboard live
-
Register your MCP upstreamAdd my internal MCP at svc.internal:9000 behind Jetski with OAuth required.✓ コピーしました→ Jetski URL returned
-
Share onboarding linkGive me the copy/paste Claude Desktop config for this gateway URL.✓ コピーしました→ Working config snippet
結果: An authenticated, per-user MCP without touching upstream code.
注意点
- Dex OIDC misconfig leaves users in a redirect loop — Verify issuer URL matches what clients see externally (not internal cluster DNS)
- DCR creates tons of orphan clients over time — Prune stale clients periodically; Dex supports TTL