Linear support

[nikolasleblanc]

Hey! Nexus is great. Thanks for taking care of the custom headers btw. Trying to bring my Linear MCP config into Nexus but struggling because it uses dynamic client registration: https://linear.app/docs/mcp#collapsible-28a2f832a8df.

Are there plans to integrate this type of auth in the future? Or maybe something I'm missing in the docs?

[linear]

GB-9599 Linear support

[pimeys]

Hey @nikolasleblanc. You know what, Linear was one of the first MCP servers I wanted to support, we use it ourselves! The annoying part is they do not let you to use their API keys in the MCP authentication, and I've yet to find a way to create service tokens that work without the whole OAuth dance.

And talking about that, redirecting the user to login with their browser feels a bit weird in a server installation. Especially if you need to do it for multiple different MCP servers.

There's a few options here I'm eyeing on. First one is of course utilizing the Identity Assertion Authorization Grant. Here you have one IDP, which then lets you to login to Nexus. Nexus uses an ID token when it connects to the downstream server, asking a ID-JAG token for this specific server from the IDP. This lets us to introduce one authentication in the frontend, and run downstream connections with the user credentials. Okta is heavily working on this, and they were discussing it in the Microsoft MCP conference earlier this summer. We already have the basis of this implemented with the token forwarding.

The second, easier thing would be to just discuss with Linear and ask if they would let us to use service tokens with the MCP server. Maybe it is there, maybe my account just doesn't have rights to create them? This is something I plan to do this week just out of curiosity.

[nikolasleblanc]

Awesome, thanks so much @pimeys!

[shaunaa126]

+1 on support for Dynamic Client Registration

Apollo MCP Server that I am trying to integrate with Nexus requires it: https://www.apollographql.com/docs/apollo-mcp-server/auth#implement-authorization-with-apollo-mcp-server

[pimeys]

@shaunaa126 have you tried the token forward with Apollo or Linear?

I'm also interested in continuing working on this, but my take is that just having the login link appearing on the console is not going to be it for Nexus.

We need something that lets the user login once once in Nexus, which can then provide authentication to downstream servers...

[shaunaa126]

@pimeys i do not have Linear.. but for Apollo MCP Server, I think it is a hard requirement (as part of MCP standards) for authentication to go through Dynamic Client Registration.. so i am not sure if just passing it forward is going to work.. we are still working through our IDP provider to see how this would work.

[pimeys]

Yeah, we need a common auth, something like this:

https://mcp-staging-aaronpk-enterprise-mcp.mintlify.app/specification/draft/basic/enterprise-managed-authorization

Btw, we are also building a federated GraphQL server, that does work with service tokens and has a similar MCP design as we have in Nexus:

https://github.com/grafbase/grafbase

Feel free to try out if that works for you. It's 100% Apollo compliant and many times faster.

Btw, we had a conference this weekend, and I was demoing Nexus right after Apollo's CEO was demoing their MCP server. Told him that they should support more ways to authenticate than just the dynamic client registration. Or maybe it is possible with a good IDP, I really need to get back to this when I finish a few more urgent tasks next week...