byward

A sign-in gate for MCP servers.

Release v0.1.0 · open source · Apache-2.0

Try it

With an Entra app registration and a sealing key (the quickstart walks through both):

docker run --rm -p 8080:8080 \
  -v "$PWD/byward-data:/var/lib/byward" \
  -v "$PWD/entra-client-secret:/run/secrets/entra-client-secret:ro" \
  -e BYWARD_PUBLIC_URL=https://mcp.example.com/mcp \
  -e BYWARD_UPSTREAM_URL=http://upstream.internal:3001/mcp \
  -e BYWARD_ENTRA_TENANT="$TENANT_ID" \
  -e BYWARD_ENTRA_CLIENT_ID="$APP_ID" \
  -e BYWARD_ENTRA_CLIENT_SECRET_FILE=/run/secrets/entra-client-secret \
  -e BYWARD_LISTEN=0.0.0.0:8080 \
  ghcr.io/byward-dev/byward:v0.1.0

Then point your MCP client at https://mcp.example.com/mcp.

What it does

byward sits in front of any MCP server and makes every user sign in with your identity provider before a single request reaches it. MCP clients such as Claude Code connect to byward with standard OAuth 2.1; byward signs the user in with Microsoft Entra ID, shows a consent page, and issues its own short-lived tokens. Your MCP server never sees a token from the client or the IdP.

MCP client → byward (OAuth 2.1, consent, Entra sign-in) → your MCP server

Why byward

One binaryA single Go binary or container. Configured by five environment variables. Built-in SQLite; no Redis, no database server.

Entra done properlySingle-tenant apps, v2 tokens, app roles and groups as an access gate, clear fixes for every AADSTS error.

Consent before sign-inUsers see which app is asking, who publishes it and where it returns to, before they reach the IdP.

No token passthroughAs the MCP spec requires. The upstream gets a request from byward, never a client's or IdP's token.

Revocation that worksRotating refresh tokens with reuse detection, a /revoke endpoint, and operator commands to sign out one user or everyone.

AuditableA structured audit stream, Prometheus metrics, and signed releases with SBOM and build provenance.

Status

In v0.1.0: HTTP and stdio MCP servers, Microsoft Entra ID, consent, refresh and revocation, SQLite state, rate limits, audit stream, byward doctor. Claude Code, Claude.ai, ChatGPT, VS Code and Cursor sign in without manual client setup (Client ID Metadata Documents and dynamic registration), verified against a real tenant.
Later: On-Behalf-Of tokens for downstream APIs, Entra app-only tokens, other identity providers.

byward is pre-1.0 and has not had an independent security audit. Read the security posture before deploying it.