Use the built-in MCP authorization server

Make AgentOS its own OAuth 2.1 authorization server for MCP connector clients. The synchronous OS-level SQLite database stores clients, codes, signing keys, and refresh tokens for local development; use synchronous PostgresDb for a restart-safe, multi-replica production deployment.

oauth_builtin.py

"""
Use the built-in MCP authorization server
=========================================

Make AgentOS its own OAuth 2.1 authorization server for MCP connector clients.
The synchronous OS-level SQLite database stores clients, codes, signing keys,
and refresh tokens for local development; use synchronous PostgresDb for a
restart-safe, multi-replica production deployment.

Prerequisites: OPENAI_API_KEY, AGENTOS_URL, and MCP_CONNECT_SECRET (16+ chars)
Optional: AGENTOS_MCP_SIGNING_KEY (32+ high-entropy chars)
Run: .venvs/demo/bin/python cookbook/05_agent_os/14_mcp/oauth_builtin.py
Try: Inspect GET /.well-known/oauth-protected-resource/mcp
"""

from agno.agent import Agent
from agno.db.sqlite import SqliteDb
from agno.models.openai import OpenAIResponses
from agno.os import AgentOS, AgentOSBuiltinAuth

# ---------------------------------------------------------------------------
# Create an OAuth-enabled AgentOS
# ---------------------------------------------------------------------------

db = SqliteDb(
    id="mcp-oauth-builtin-db",
    db_file="tmp/mcp_oauth_builtin.db",
)

oauth_agent = Agent(
    id="oauth-assistant",
    name="OAuth Assistant",
    model=OpenAIResponses(id="gpt-5.5"),
    db=db,
    instructions="Answer authenticated connector users concisely.",
)

agent_os = AgentOS(
    id="mcp-oauth-builtin-os",
    description="AgentOS with its built-in MCP OAuth authorization server.",
    db=db,
    agents=[oauth_agent],
    mcp=True,
    mcp_auth=AgentOSBuiltinAuth.from_env(),
)
app = agent_os.get_app()

# ---------------------------------------------------------------------------
# Run OAuth AgentOS
# ---------------------------------------------------------------------------

if __name__ == "__main__":
    agent_os.serve(app=app)

Run the Example

Set up your virtual environment

uv venv --python 3.12
source .venv/bin/activate

Install dependencies

uv pip install -U "agno[mcp,os]" openai

Export environment variables

Use your externally reachable HTTPS origin and a random MCP_CONNECT_SECRET of at least 16 characters. AGENTOS_MCP_SIGNING_KEY is optional; leave it unset to use the database-persisted generated key.

export AGENTOS_URL="https://agentos.example.com"
export MCP_CONNECT_SECRET="your_mcp_connect_secret_here"
export OPENAI_API_KEY="your_openai_api_key_here"

Run the example

Save the code above as oauth_builtin.py, then run:

python oauth_builtin.py

Connect an MCP client

Expose the running app at the exact HTTPS origin configured in AGENTOS_URL, then add that origin’s /mcp endpoint to your connector. Inspect /.well-known/oauth-protected-resource/mcp on that origin if discovery fails. Enter MCP_CONNECT_SECRET on the consent page. The optional signing key can remain unset: this example’s synchronous database persists generated signing material.

Full source: cookbook/05_agent_os/14_mcp/oauth_builtin.py