MCP Auth Trigger

MCP Server Trigger with Auth0 Bearer token validation. Connect tools via the ai_tool port exactly like the native MCP Server Trigger.

MCP Auth Trigger

AI-generated

Summary

Serves connected n8n AI tools as a stateless MCP endpoint over HTTP. Optionally validates incoming Bearer tokens with Auth0 and forwards either the caller’s token or a separately requested Auth0 client-credentials token to each tool call.

Inputs

  • Path (required) — Endpoint path; defaults to mcp-auth.
  • Token Validation — Choose None (default) or Auth0 (JWKS Signature) to verify the incoming Bearer token against the configured Auth0 domain.
  • Auth0 Domain — Auth0 tenant domain used for token verification and, in client-credentials mode, token requests.
  • Reject Invalid Tokens — Shown for Auth0 validation; defaults to true. When enabled, missing or invalid tokens receive HTTP 401. Otherwise, the request proceeds with invalid-token details passed to tools.
  • Downstream Tool Access Token — Choose Forward Caller’s Token (default) or Client Credentials (M2M). The selected token is supplied to each tool as access_token.
  • M2M Client ID (required) — Required in client-credentials mode; Auth0 Machine-to-Machine application client ID.
  • M2M Client Secret (required) — Required in client-credentials mode; Auth0 Machine-to-Machine application secret.
  • Downstream Audience (required) — Required in client-credentials mode; API audience for the requested access token.

Output shape

Stateless MCP HTTP endpoint; no n8n output items.

Connect tools through the AI Tool input. MCP clients can list and call those tools at the configured path. Tool calls receive access_token and _auth fields alongside the caller’s arguments; _auth contains caller token details and validation status. Tool results are returned as MCP text content, with tool lookup, execution, or M2M token errors reported as MCP errors. M2M tokens are cached until shortly before expiry.

Links

Discussion