Contribution proposal: ZeroAuth compatibility with an MCP server

[JirA44]

I’d like to evaluate and contribute an integration between ZeroAuth and an existing MCP server. The server validates JWT access tokens through JWKS and uses issuer, audience, scopes, and a custom project-access claim.

I can contribute a small, reproducible compatibility test and documentation covering token signature validation, JWKS key rotation, scopes, and custom claims. If the current setup needs changes in ZeroAuth, I’ll document the gap and propose a focused patch.

Before I start, is there an existing OIDC integration test pattern or preferred test environment in the repository that I should build on?

[JirA44]

I’m evaluating ZeroAuth as the identity provider for a local MCP server that ChatGPT reaches through OpenAI’s Secure MCP Tunnel.

The MCP server accepts an access token only after validating its signature, issuer, audience and expiry through JWKS. It also relies on OAuth scopes (tasks:submit, tasks:read, tasks:cancel) and a custom project_ids claim to enforce least-privilege access and keep each user’s tasks restricted to their authorized projects.

ZeroAuth’s public materials describe OAuth 2.0/OIDC, JWTs and JWKS. However, I could not confirm from the documentation whether this particular setup is supported:

• Which signing algorithms are used for access tokens, and can the server validate them using the published JWKS?
• Can a resource server define and validate its own audience?
• Can an application request these scopes and receive them in the access token?
• Can administrators configure a custom claim such as project_ids, with a stable namespace and documented format?
• Are key rotation and token validation covered by an integration-test example?
  These details matter because the MCP server performs actions on a user’s machine. Without verified issuer, audience, scope and project checks, we cannot safely establish that a token is intended for this server or limit its access to the right projects.

I’d like to contribute a reproducible OIDC compatibility test and setup documentation for this MCP use case. If the current implementation already supports these features, I can document and test the configuration. If it does not, I can first propose a focused change. Is there an existing integration-test pattern or preferred test environment I should use?