Add OAuth to an MCP server that doesn't speak it
언제 쓸까: Your MCP works great locally but the upstream has no auth; you need identity before exposing it.
사전 조건
- Kubernetes cluster (or k3s/minikube for dev) — Jetski uses Metacontroller + CRDs
- PostgreSQL — Any reachable PG; Jetski creates its schema
흐름
-
Deploy JetskiApply Jetski's Helm chart to my cluster; confirm all pods ready.✓ 복사됨→ Gateway + dashboard live
-
Register your MCP upstreamAdd my internal MCP at svc.internal:9000 behind Jetski with OAuth required.✓ 복사됨→ Jetski URL returned
-
Share onboarding linkGive me the copy/paste Claude Desktop config for this gateway URL.✓ 복사됨→ Working config snippet
결과: An authenticated, per-user MCP without touching upstream code.
함정
- Dex OIDC misconfig leaves users in a redirect loop — Verify issuer URL matches what clients see externally (not internal cluster DNS)
- DCR creates tons of orphan clients over time — Prune stale clients periodically; Dex supports TTL