External OAuth Support for MCP Server — Enable Per-User Authentication from MCP Hubs

[steveterryp]

Select Topic Area

Product Feedback

Copilot Feature Area

Copilot Agent Mode

Body

I've filed a feature request on the GitHub MCP Server repo for External OAuth / Custom Authorization Server
support: github/github-mcp-server#2224

Posting here for broader visibility and to gather community interest.

The Problem

MCP Hubs that orchestrate multiple services on behalf of users currently have two options for GitHub integration:

• PAT (service account): All operations attributed to one account — no per-user audit trail
• Store GitHub OAuth tokens: Security risk — the Hub must retain provider tokens long-term

What We've Built

We've production-validated a per-user authentication pattern with Snowflake's MCP integration using their
External OAuth feature:

1. User authenticates to our MCP Hub
2. Hub mints an RS256 JWT with the user's identity (email, role)
3. Hub forwards the JWT to a Snowflake MCP service
4. Snowflake validates the JWT against our public JWKS endpoint
5. Snowflake maps the email claim to a local user account
6. Query executes as that user with their permissions

No stored credentials. No shared service accounts. Full per-user audit trail.

This works because Snowflake supports External OAuth with custom authorization servers — they accept third-party
JWTs validated via JWKS.

The Ask

If GitHub's MCP server supported a similar External OAuth pattern:

• Each user's PRs, issues, and commits would be attributed to them
• MCP Hubs wouldn't need to store GitHub tokens
• GitHub's audit log would show the actual user, not a service account
• It aligns with zero-trust principles (JWKS validation, no shared secrets)

Who Benefits

• MCP Hub operators running multi-user platforms (like us)
• Enterprise teams using MCP for code automation who need per-user attribution
• Security teams who don't want OAuth tokens stored in intermediary systems

Full technical details and reference implementation in the issue:
github/github-mcp-server#2224

Would love to hear if others in the community have similar needs.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐