[DEPRECATED] Superseded by systempromptio/systemprompt-template and systempromptio/systemprompt-core. Reference MCP server implementation (OAuth 2.1, tools, prompts, resources, sampling, notifications).
# Add to your Claude Code skills
git clone https://github.com/systempromptio/systemprompt-mcp-serverGuides for using mcp servers skills like systemprompt-mcp-server.
Last scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@eslint/plugin-kit: @eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser",
"severity": "low"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "body-parser: body-parser is vulnerable to denial of service when url encoding is used",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
"severity": "high"
},
{
"type": "npm-audit",
"message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
}
],
"status": "WARNING",
"scannedAt": "2026-05-30T17:02:34.002Z",
"npmAuditRan": true,
"pipAuditRan": true
}No comments yet. Be the first to share your thoughts!
Top skills in this category by stars
⚠️ Deprecated — no longer maintained
This repository has been superseded. All new development and support lives in:
- systempromptio/systemprompt-template — start here. Self-hosted evaluation of the full systemprompt.io AI governance infrastructure.
- systempromptio/systemprompt-core — the underlying Rust library (MCP, A2A, OAuth 2.1, audit, compile-time extensions).
Learn more at systemprompt.io.
The original README is preserved below for historical reference.
This MCP server implementation is sponsored by systemprompt.io — creators of the world's first native mobile MCP client for iOS and Android — and provided completely free and open source to the community.
If you find this project useful, we'd appreciate:
Your support helps us continue creating valuable open source tools for the AI community!
🚀 Learn More: For an interactive walkthrough of this implementation with live SDK testing, visit systemprompt.io/mcp-server
A production-ready Model Context Protocol (MCP) server that demonstrates the complete MCP specification including OAuth 2.1, sampling, elicitation, structured data validation, and real-time notifications.
This implementation uses Reddit as a real-world example to demonstrate OAuth 2.1 flow and advanced MCP features, but the architecture is designed to be easily adapted for any API that requires OAuth authentication.
This server works with any MCP-compliant client that supports advanced features like sampling and notifications.
This server is fully compatible with the MCP Inspector, providing perfect support for:
Test it yourself: npm run inspector
This implementation uses Reddit's API as a real-world example to demonstrate how to build a complete OAuth 2.1 flow in an MCP server. Reddit was chosen because:
Note: While this server uses Reddit, the OAuth implementation and architecture patterns are designed to be easily adapted for any OAuth-based API (GitHub, Google, Slack, etc.).
This repository serves as the gold standard for MCP server implementations, showcasing:
Run the server instantly with Docker - no installation required:
Create a Reddit app at reddit.com/prefs/apps
http://localhost:3000/oauth/reddit/callbackCreate initial .env file:
cat > .env << EOF
REDDIT_CLIENT_ID=your_reddit_client_id
REDDIT_CLIENT_SECRET=your_reddit_client_secret
JWT_SECRET=any_random_string_here
EOF
# Run with Docker (pulls image automatically)
docker run -it --rm \
-p 3000:3000 \
--env-file .env \
--name mcp-reddit \
node:20-slim \
npx @systemprompt/systemprompt-mcp-server
http://localhost:3000# Stop the container (Ctrl+C)
# Add the OAuth token to your .env file
echo "OAUTH_ACCESS_TOKEN=your_oauth_token_here" >> .env
# Restart with the token
docker run -it --rm \
-p 3000:3000 \
--env-file .env \
node:20-slim \
npx @systemprompt/systemprompt-mcp-server
Now you can use all Reddit tools with your authenticated session!
# Via npm
npm install -g @systemprompt/systemprompt-mcp-server
# Via npx (no installation)
npx @systemprompt/systemprompt-mcp-server
# Clone for development
git clone https://github.com/systempromptio/systemprompt-mcp-server.git
cd systemprompt-mcp-server
npm install
npm run build
Create Reddit App: reddit.com/prefs/apps
http://localhost:3000/oauth/reddit/callbackSet Environment Variables:
Create a .env file in the project root:
# Required for Reddit API
REDDIT_CLIENT_ID=your_reddit_client_id
REDDIT_CLIENT_SECRET=your_reddit_client_secret
JWT_SECRET=your_jwt_secret # Secret for JWT signing
# Optional
PORT=3000 # Server port (default: 3000)
OAUTH_ISSUER=http://localhost:3000 # OAuth issuer URL
REDIRECT_URL=http://localhost:3000/oauth/reddit/callback # OAuth redirect
REDDIT_USER_AGENT=linux:systemprompt-mcp-reddit:v2.0.0 # Reddit user agent
REDDIT_USERNAME=your_reddit_username # Your Reddit username (optional)
LOG_LEVEL=debug # Logging level (debug, info, warn, error)
Note: Environment variables are required for both local development and Docker deployment.
# Build the TypeScript code
npm run build
# Run the built server
node build/index.js
# Development with watch mode
npm run watch
# In another terminal:
node build/index.js
# With Docker
npm run docker
This implementation follows clean architecture principles with clear separation between layers:
┌─────────────────────────────────────────────────────────┐
│ Client Application │
│ (systemprompt.io) │
└────────────────────────┬────────────────────────────────┘
│ MCP Protocol
┌────────────────────────┴────────────────────────────────┐
│ MCP Server Layer │
│ ┌─────────────┐ ┌─────────────┐ ┌────────────────┐ │
│ │ OAuth 2.1 │ │ Session │ │ Notification │ │
│ │ Handler │ │ Manager │ │ Manager │ │
│ └─────────────┘ └─────────────┘ └────────────────┘ │
└────────────────────────┬────────────────────────────────┘
│
┌────────────────────────┴────────────────────────────────┐
│ Handler Layer │
│ ┌─────────────┐ ┌─────────────┐ ┌────────────────┐ │
│ │ Tools │ │ Resource