Hi, and welcome to this AI&TCI video.
Not on the MyFrost Agent Framework today,
but instead the Model Context Protocol.
So in this video, I'm going to show you that we can use MCP,
but if we want to have it so only certain people can use it,
we need to put some authentication onto it.
In this video, I'm going to show you how to add an API key to it.
So let's jump into some code.
And this code I'm showing right here is my old sample in my previous video,
in that we can just use the MCP NuGet package and the HPNet core
if we want to expose them using the minimal API.
And then we just go in and say add MCP server with HTTP transport
with tools from assembly.
And the tools will just be annotated with this MCP server tool type
and an MCP server here.
And here I'm just making a little sample tool called GetSecretWord.
But if we look at code like this,
we're just exposing that's MCP, but without any restrictions.
Anyone who knows this URL that it's on will know you can just write
that that's MCP and can be used.
But it could be that you had some corporate data, some company data,
some private data that you want to expose through MCP,
and only if people knew the API key, it should be possible.
That's a little the same as if we look at the sample about using GitHub MCP
when we use the MCP client.
We give a MCP server, but we give some additional headers
with an authorization token in this case.
So we want something similar.
So we want something similar, but on the server side.
And for that, we have tools calling an MCP, MCP auth, and MCP auth API key here.
So up in this, we have almost the same as we saw before,
but we have put in our expected API key,
which in my case, I've just put in as my secret key.
It should, of course, be something like a GWT or something like that,
and it should, of course, be kept in some secret storage.
But beyond that, after we take this,
we just need to add an endpoint filter,
just like you do in normal minimal API.
So there's nothing different when it comes to just API keys.
And the tools are also not changed in any way.
It's just the same tool I've copied over.
But if we do this and run the code, which I've already done,
and we can see we are on localhost 7044,
I can take a MCP client, like, for example, Insomnia here,
and connect to it.
And if I don't have any headers,
like in my case, I call it XAPI key,
but you could call it secret.
You could call it authorization.
There's no fixed standard for this.
You can just call it what you want.
And if I don't have this, I have something wrong.
We will see that I get an error back,
and we will be able to see I'm getting unauthorized.
And the reason for that is that whenever we hit the endpoint now,
if I press connect here,
we hit the breakpoint,
we on the fly take it from the request, the API key,
and if it doesn't match what we have put in,
our MySecret key,
we just send back unauthorized.
But if we go in and put the right key in,
we then go to the normal middleware and just call the await next,
so it sends it on in the pipeline.
And we get multiple because it checks for various,
what tools do we have, what resources do we have, and so on.
And we get a connection
where we can then call our getSecretWord.
Where we can then call our getSecretWord,
which in our case is banana cake here.
So there's actually not more to it
to make a simple authentication using an API key,
meaning this part of the code.
And it takes care of protecting all tools and stuff.
You can't really put credentials on a per-tool basis.
It's on the entire MCP or not.
So that's what we have here.
Some of you might be thinking, okay, we also have OAuth.
OAuth is a very big deal in it,
and it's very, very difficult to get working.
I'm still in the process of making one.
I have some code that I will commit that you can see as inspiration.
But right now it's half working only.
So that will be for another video.
But if anyone with great security skills,
because I don't have great security,
can help me make this work, we might get a video faster.
But it's close to working, but not 100%.
But we will take that in another video.
For now, you can definitely secure your endpoint
with a simple API key like this.
So with that, thank you for attending and see you in the next one.