Authentication

Security perspective on Argus MCP authentication — incoming client auth modes and management API protection.

Authentication is the first layer of Argus MCP's security model. It verifies the identity of every incoming MCP client connection before any tool call reaches a backend.

Auth Modes

Argus supports four incoming authentication modes:

ModeSecurity LevelUse Case
anonymousNoneLocal development, trusted networks
localBasicSingle-user with a management token
jwtStrongMulti-user with external identity provider
oidcStrongOpenID Connect with automatic discovery

Note:

For full configuration reference including all fields, examples, and identity model details, see Configuration — Authentication.

Security Defaults

  • Default mode: anonymous — no authentication required
  • Management API: Always requires a bearer token regardless of auth mode
  • Identity propagation: Authenticated identity is attached to the request context and available to authorization, audit, and middleware

Recommendations

  • Use jwt or oidc for any production deployment
  • Always set a strong management_token (or use secret:mgmt_token reference)
  • Enable audit logging to track authentication events
  • Combine with Authorization for fine-grained access control