How it works

TuraMCP is an authorization server for remote MCP. It is not a tool host. You run /mcp. We issue tokens humans earn with email login.

  1. 1

    Create a project

    A project is the resource / audience id for one MCP server or environment. For the hosted demo, OAuth creates this for you on first Allow.

  2. 2

    Protect your MCP server

    Publish Protected Resource Metadata pointing at TuraMCP as authorization_servers. Validate JWTs against TuraMCP JWKS (or PATs via introspect). Use mcp-asgi-http JwtAuth for FastAPI.

  3. 3

    User connects in Cursor or Claude

    They add the MCP URL with no long-lived shared password. The client runs OAuth; TuraMCP shows email login; a short-lived token returns to the client. PATs remain for CI.

  4. 4

    Every tool call carries Bearer

    Authorization: Bearer <access_token>. Your server checks the token and audience. Wrong aud is rejected.

Resource server snippet (Phase 2)

auth = JwtAuth(
    issuer="https://turamcp.com",
    audience="https://customer-mcp.example.com",
    jwks_url="https://turamcp.com/.well-known/jwks.json",
)
app = mount_mcp(api, server, auth=auth)

Phase 1 ships PATs first. OAuth AS + JWKS follow. Until then, validate mcp_live_ tokens on your server.