MCP Authorization

MCP authorization is the part of the Model Context Protocol specification that defines how an AI client obtains and presents OAuth access tokens to a remote MCP server over HTTP, built on a subset of the OAuth 2.1 draft plus RFC 9728 (Protected Resource Metadata), RFC 8414 (Authorization Server Metadata), RFC 8707 (Resource Indicators), and Client ID Metadata Documents. It is a specification published by the MCP project, not an IETF standard; the current revision at the time of writing is dated 2026-07-28, and servers using the local STDIO transport are told not to use it and to read credentials from the environment instead.

In practice the MCP server acts as an OAuth resource server, returns a 401 that points to its protected resource metadata, and the client discovers the authorization server, registers (pre-registration first, then a Client ID Metadata Document, then Dynamic Client Registration as a fallback), and runs the authorization code flow with PKCE and a resource parameter. Two rules carry most of the security weight: tokens must be audience-bound to the specific MCP server, and an MCP server must not pass a client's token through to upstream APIs, which prevents the confused deputy problem. Optional extensions, kept in a separate repository, add Enterprise-Managed Authorization (Cross App Access via ID-JAG) and OAuth client credentials for machine-to-machine use. For security teams, the open issue is less the protocol than inventory: knowing which MCP servers employees have connected and what each token can reach.

See also: protected resource metadata, resource indicators, Client ID Metadata Document, Cross App Access, agentic identity, PKCE, OAuth 2.1, agent instruction injection, agent identity standards map 2026