Start here
A minimal, brand-neutral base for a multi-tenant SaaS product with protected agent tools.
The starter is a single Bun and Cargo monorepo. Its Rust API owns identity and tenant data, the Next.js application acts as a browser-facing BFF, and the MCP service validates short-lived access tokens locally.
Run it locally
Database, keys, environment, and development commands.
Understand the boundary
See which process owns each security decision.
Connect an agent
Discover, authorize, and call the MCP server.
Included
- Password registration and sign-in
- Generic upstream OpenID Connect providers
- Opaque application sessions in an HttpOnly cookie
- Workspaces, projects, roles, and scoped API keys
- OAuth Authorization Code with S256 PKCE, refresh rotation, DCR, and client ID metadata documents
- OpenID Connect discovery, ID tokens, JWKS, and UserInfo
- Protected-resource metadata and a Streamable HTTP MCP endpoint
The starter deliberately leaves product behavior, billing, queues, deployment, and vendor branding to the consuming project.