byward

A sign-in gate for MCP servers.

Pre-release · open source · Apache-2.0

Try it

With an Entra app registration and a sealing key (the quickstart walks through both):

docker run --rm -p 8080:8080 \
  -v "$PWD/byward-data:/var/lib/byward" \
  -v "$PWD/entra-client-secret:/run/secrets/entra-client-secret:ro" \
  -e BYWARD_PUBLIC_URL=https://mcp.example.com/mcp \
  -e BYWARD_UPSTREAM_URL=http://upstream.internal:3001/mcp \
  -e BYWARD_ENTRA_TENANT="$TENANT_ID" \
  -e BYWARD_ENTRA_CLIENT_ID="$APP_ID" \
  -e BYWARD_ENTRA_CLIENT_SECRET_FILE=/run/secrets/entra-client-secret \
  -e BYWARD_LISTEN=0.0.0.0:8080 \
  ghcr.io/byward-dev/byward:latest

Then point your MCP client at https://mcp.example.com/mcp.

What it does

byward sits in front of any MCP server and makes every user sign in with your identity provider before a single request reaches it. MCP clients such as Claude Code connect to byward with standard OAuth 2.1; byward signs the user in with Microsoft Entra ID, shows a consent page, and issues its own short-lived tokens. Your MCP server never sees a token from the client or the IdP.

MCP client → byward (OAuth 2.1, consent, Entra sign-in) → your MCP server

Why byward

One binaryA single Go binary or container. Configured by five environment variables. Built-in SQLite; no Redis, no database server.

Entra done properlySingle-tenant apps, v2 tokens, app roles and groups as an access gate, clear fixes for every AADSTS error.

Consent before sign-inUsers see which app is asking, who publishes it and where it returns to, before they reach the IdP.

No token passthroughAs the MCP spec requires. The upstream gets a request from byward, never a client's or IdP's token.

Revocation that worksRotating refresh tokens with reuse detection, a /revoke endpoint, and operator commands to sign out one user or everyone.

AuditableA structured audit stream, Prometheus metrics, and signed releases with SBOM and build provenance.

Status

Works today: HTTP MCP servers, Microsoft Entra ID, Claude Code, consent, refresh and revocation, SQLite state, rate limits, audit stream.
Coming in v0.1: sign-in for Claude.ai, VS Code and Cursor without manual client setup (Client ID Metadata Documents and dynamic registration), stdio MCP servers, byward doctor.
Later: On-Behalf-Of tokens for downstream APIs, Entra app-only tokens, other identity providers.

byward is pre-1.0 and has not had an independent security audit. Read the security posture before deploying it.