who-mcp-stdio

who-mcp-stdio is a local stdio MCP server that transparently proxies an upstream Streamable HTTP MCP endpoint.

It acquires an Azure AD bearer token inside the MCP process using Azure CLI credentials first, then falls back to interactive browser credentials. Every upstream HTTP MCP request is sent with:

Authorization: Bearer <azure-access-token>

Usage

npx who-mcp-stdio --endpoint https://your-host.example.com/mcp

For the hosted Who-Next server, request a Microsoft tenant token explicitly:

npx who-mcp-stdio --endpoint https://who.ttthree.space/mcp --microsoft-tenant

Local development against the repo package:

cd who-mcp-stdio
npm install
npm run build
node dist/index.js --endpoint http://localhost:12345/mcp

Options

--endpoint <url>       Required. Streamable HTTP MCP endpoint, e.g. https://host/mcp
--tenant-id <id>      Azure tenant id. Defaults to WHO_MCP_TENANT_ID, AAD_TENANT_ID, or AZURE_TENANT_ID
--microsoft-tenant   Shortcut for Microsoft tenant (72f988bf-86f1-41af-91ab-2d7cd011db47)
--scope <scope>       Azure token scope. Defaults to https://graph.microsoft.com/.default
--allow-dev-token     Fallback to dev_token if Azure auth fails. Also enabled by ALLOW_DEV_TOKEN=true
--timeout-ms <ms>     Upstream MCP request timeout. Defaults to 60000
--verbose             Log token and proxy diagnostics to stderr
--help                Show help

Environment variables:

WHO_MCP_ENDPOINT=http://localhost:12345/mcp
WHO_MCP_TENANT_ID=<tenant-id>
WHO_MCP_SCOPE=https://graph.microsoft.com/.default
ALLOW_DEV_TOKEN=false

Claude Desktop example

{
  "mcpServers": {
    "who-next": {
      "command": "npx",
      "args": [
        "who-mcp-stdio",
        "--endpoint",
        "https://your-host.example.com/mcp",
        "--tenant-id",
        "<tenant-id>"
      ]
    }
  }
}

Authentication flow

1. Try AzureCliCredential, so az login works without extra prompts.
2. Fall back to InteractiveBrowserCredential when Azure CLI credentials are unavailable or invalid.
3. Persist interactive-browser tokens in the OS/user token cache under who-mcp-stdio.
4. Persist the selected browser account record at ~/.IdentityService/who-mcp-stdio.authentication-record.json, so future processes can use silent auth.
5. Cache the active process token until five minutes before expiry.
6. Optionally use dev_token only when --allow-dev-token or ALLOW_DEV_TOKEN=true is set.

Notes

• The upstream endpoint must support MCP Streamable HTTP transport.
• The proxy mirrors upstream tools, resources, prompts, completions, and logging capabilities where advertised.
• Logs are written to stderr only, preserving stdio MCP protocol messages on stdout.