Download the PHP package sjs/neos-mcp-oauth without Composer

On this page you can find all versions of the php package sjs/neos-mcp-oauth. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:
If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.
Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

  • Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
  • To use Composer is sometimes complicated. Especially for beginners.
  • Composer needs much resources. Sometimes they are not available on a simple webspace.
  • If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
  • Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.
Please rate this library. Is it a good library?

Informations about the package neos-mcp-oauth

SJS.Neos.MCP.OAuth

OAuth 2.0 authentication layer for the Neos MCP server. Enables MCP clients (Claude Desktop, VS Code, etc.) to authenticate against the Neos backend using the standard Authorization Code flow with PKCE.

Built on league/oauth2-server using opaque tokens — no JWT signing key management required.

How It Works

When an unauthenticated user hits the authorize endpoint, they are redirected to the Neos login page. After login, an AOP aspect (LoginRedirectAspect) redirects them back to complete the OAuth flow seamlessly.

Endpoints

RFC 8414 — Authorization Server Metadata

Route Method Description
/.well-known/oauth-authorization-server GET Server metadata discovery (endpoints, scopes, grant types)

OAuth 2.0 Endpoints

Route Method Description
/oauth/mcp/authorize GET, POST Authorization endpoint (Authorization Code flow)
/oauth/mcp/token POST Token endpoint (exchange code for access/refresh tokens)
/oauth/mcp/register POST Dynamic Client Registration (RFC 7591)

All OAuth endpoints are accessible to Neos.Flow:Everybody — authentication happens at the authorize step via the Neos backend login.

Configuration

Quick Setup

Token Format

The server uses opaque tokens (random strings stored in the database) rather than JWTs. This means:

Token Lifecycle

  1. Client authenticates via Authorization Code flow → receives access_token + refresh_token
  2. access_token is used as Authorization: Bearer <token> on MCP requests
  3. Expired access tokens can be refreshed via the refresh token grant
  4. Tokens can be revoked through the backend module

Connection Provider Chain

This package replaces the default ConnectionProviderInterface with ChainedConnectionProvider (configured in Objects.yaml):

This means existing static-token configurations continue to work alongside OAuth.

Backend Modules

MCP OAuth Manager (/neos/administration/mcp/oauthClientModule)

Admin module for managing all OAuth clients across all users. Requires Neos.Neos:Administrator role.

OAuth Clients (/neos/mcp/oauthClients)

User-facing module where editors can manage their own OAuth client applications. Requires Neos.Neos:AbstractEditor role.

Both modules support: create, edit, delete clients, regenerate secrets, list active tokens, and revoke tokens.

CLI Commands

Command Description
./flow oauth:generateEncryptionKey Generate a hex-encoded 32-byte encryption key

Related

All versions of neos-mcp-oauth with dependencies

PHP Build Version
Package Version
Requires neos/neos Version ^9.0
league/oauth2-server Version ^8.5
sjs/flow-mcp Version ^1.0
sjs/neos-mcp Version ^1.0
Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package sjs/neos-mcp-oauth contains the following files

Loading the files please wait ...