mcpauth vs. mcp-auth.dev

The names are close enough that even AI search tools mix these up — we've seen it happen. To be direct: we are not affiliated with mcp-auth.dev in any way. It's a real, separate project by Silverhand (the company behind the Logto identity platform), published as mcp-auth on npm and mcpauth on PyPI, at github.com/mcp-auth.

The core difference: a hosted server vs. an adapter to a server you already have

This isn't the same shape of comparison as our other pages. mcp-auth.dev doesn't run an authorization server at all — it's a library that connects your MCP server to a third-party identity provider you already have(Auth0, WorkOS, Logto, or another OAuth provider it's compatible with), handling the MCP-specific parts — Dynamic Client Registration, discovery — as a bridge layer in front of that existing provider. Its own docs ship a “provider compatibility checker,” because not every OAuth provider supports what MCP actually requires.

mcpauth is the opposite shape: a complete, hosted authorization server. There's no separate identity provider to select, configure, or check for compatibility — sign up, get a registration secret, and the OAuth server itself is already there.

When you'd actually want each one

If you already run Auth0, WorkOS, Logto, or another OAuth provider for the rest of your product and want your MCP server to reuse that same identity system, mcp-auth.dev's adapter model is a genuinely good fit — that's exactly the problem it's built to solve, and it now covers both Node.js and Python.

If you don't already have an OAuth provider — or you'd rather not stand one up just to protect an MCP server — mcpauth skips that step entirely. There's nothing to connect to, because the authorization server is the product.

Side by side