# Feature AI-8 - Integrate MCP Authentication with OpenProject OAuth2

Project: Stream AI
Status: closed
URL: https://community.openproject.org/work_packages/AI-8

## Planning

| Attribute | Value |
| --- | --- |
| Date | 2025-11-14 – 2026-03-31 |
| Priority | Medium |
| Target versions | 17.2.0 |
| List |  |
| Roadmap |  |
| Relevance |  |

## OPEN POINTS / FEEDBACK

_No work packages_

## Features and Chunks

| ID | Subject | Type | Status | Assignee | Target versions | Spent time |
| --- | --- | --- | --- | --- | --- | --- |
| AI-13 | Implement RFC 9728: OAuth 2.0 Protected Resource Metadata | Feature | closed |  | Product Backlog |  |
| AI-14 | Implement RFC 8414: OAuth 2.0 Authorization Server Metadata | Feature | closed |  | Product Backlog |  |

## Bugs and other work packages

_No work packages_

## Technical Details

| Attribute | Value |
| --- | --- |
| Module |  |
| Feature Flag |  |
| Requires doc change | No |
| Enterprise plan |  |

## Details

| Attribute | Value |
| --- | --- |
| Pull preview |  |
| Mockups |  |

## People

| Attribute | Value |
| --- | --- |
| Assignee |  |
| Accountable |  |
| Product manager |  |
| Developers | Jan Sandbrink |
| Designer |  |
| Ordered by |  |
| Signed off by |  |
| Interest by |  |

## Estimates and progress

| Attribute | Value |
| --- | --- |
| Work |  |
| Labor costs |  |

## Description

**As** an AI client user  
**I want to** authenticate to OpenProject’s MCP endpoints using OAuth2  
**so that** I can securely connect my AI assistant to my OpenProject data without new credentials

**Acceptance criteria**

*   MCP clients can authenticate via the same OAuth2 flow as OpenProject API clients.
    
*   PKCE flow is supported for desktop and browser-based clients.
    
*   Tokens include the new scope `mcp` (API scoping needs more clarification)
    

**Technical notes**

*   <br>
    

<br>