attesto_mcp_server - authenticated MCP for Phoenix apps

Hi all — following my earlier Attesto family announcement, I’ve released attesto_mcp_server, an Apache-2.0 library for adding an authenticated MCP endpoint to an Elixir or Phoenix SaaS application.

It builds on Attesto’s OpenID Foundation-certified provider stack, whose certifications include OIDC, FAPI 2.0, FAPI-CIBA, Session Management, and Logout profiles. Where attesto_mcp provides the OAuth resource-server boundary, this is the full MCP server: transport, catalog, validation, sessions, authorization, and Phoenix integration.

I built it because I wanted MCP to reuse an application’s existing users, tenants, scopes, and business rules—not introduce a parallel identity system.

For an app using attesto_phoenix, setup starts with:

mix igniter.install attesto_mcp_server \
  --base-url https://mcp.example.com

This creates and supervises the server, mounts /mcp and its OAuth metadata, reuses the existing issuer, revocation, principal loading, DPoP, and mTLS configuration, and adds a starter tool and test. It can also use the app’s PostgreSQL repo for durable sessions.

Other priorities included authentication before body decoding, per-tool scopes and business-policy callbacks, consistent authorization for discovery and invocation, multiple MCP mounts, and explicit limits for requests, results, concurrency, and timeouts.

It supports MCP 2026-07-28, 2025-11-25, and 2025-06-18, with reproducible conformance results in the repository.

Hex · Docs · GitHub · Livebook