Securing MCP Servers with Spring AI
summary
How to build a secure MCP (Model Context Protocol) server using Spring AI and the MCP SDK, with a practical demonstration of adding OAuth2-based access control. Covers OAuth2 integration choices (which grant types to use) and how to restrict feature-level access (e.g., admin-only actions), plus implications for client apps and the OAuth2 authorization server.
AI-written summary · about
chapters (16)
- 0:00Introduction
- 1:25MCP protocol and use cases
- 6:20Spring AI app demo
- 7:47Turning app into MCP server
- 9:13Exposing MCP tools via annotations
- 12:23MCP server with LLM client
- 14:31Secure MCP tool scheduling
- 19:15Secure MCP dependencies
- 20:23MCP security challenges
- 28:07MCP auth spec evolution
- 30:14MCP-compatible auth server setup
- 33:01Securing MCP with Spring Security
- 36:14Auth and permissions demo
- 39:09MCP clients integration
- 41:13Developer resources
- 42:37Q&A
related talks
26mSecure Your MCP Servers with OAuth, JWT, SPIFFE and More
25mSecure Your MCP Servers With OAuth, JWT, SPIFFE and More
52mBeyond local tools: Deep dive into MCP with Spring AI
15mFast Focus - Introduction to Model Context Protocol (MCP) Servers
26mBuilding AI-Enabled Spring Applications with Model Context Protocol (MCP)
22mSAFE-MCP: A Security Framework for AI+MCP (Model Context Protocol)
32mAI Agents with Keycloak in MCP
15mWhy Security Matters: The Risks of Agentic AI and How to Mitigate Them