Hi everyone,
I wanted my AI assistants to read my private repositories on my own Gitea instance, not just in local coding tools but also in the web chats of claude.ai and ChatGPT. gitea-mcp already provides the tools, but web MCP clients require OAuth with Dynamic Client Registration, and Gitea doesn’t offer DCR. So I built a small fork in which gitea-mcp acts as a minimal OAuth 2.1 authorization server and lets you log in with your Gitea account:
It works end to end with both claude.ai and ChatGPT (Plus, in developer mode), connected to the same server at the same time.
How it works
- The web client registers itself dynamically and receives a signed client ID. Nothing is stored, so registrations survive restarts.
- You log in through a normal Gitea OAuth2 app. gitea-mcp requests fixed read-only scopes and only lets one configured Gitea user authorize.
- The client gets its own short-lived tokens from gitea-mcp. Your Gitea token stays on the server and is never handed to the web client.
- Only explicitly allowlisted client redirect URIs are accepted, with exact matching.
Read-only, enforced in layers
- Gitea only issues read scopes (verified against Gitea 1.27.3 by trying writes with such a token).
- Write tools are not registered at all in read-only mode.
- An HTTP transport blocks every request other than GET/HEAD before it leaves the server.
- A few read tools that can expose sensitive data (CI logs, artifacts, Actions secrets and variables) are hidden in OAuth mode.
Setup is a Docker container behind your existing reverse proxy; deploy/README.md walks through it. One tip for ChatGPT: each new connector uses its own callback URL, and the first connection attempt fails with an error that shows that exact URL. Add it to the allowlist, restart, and connect again.
The design, the security model and the deliberate limitations (single user, sessions in memory, no rate limiting yet) are documented in docs/oauth/SPEC.md.
To the gitea-mcp maintainers: the read-only hardening doesn’t depend on OAuth and might be useful upstream on its own. If any of this is of interest, I’d be happy to prepare PRs in whatever shape suits the project, or to keep it as a fork if it doesn’t fit.
It was built with AI coding agents under careful human review, with independent audits of the security-critical parts. Feedback is very welcome, especially on the security side; vulnerabilities please via the contact in SECURITY.md rather than in public.
Thanks to the Gitea and gitea-mcp teams for the great foundation!