Security

Authorization for remote servers

Remote servers use OAuth 2.1. The MCP server acts as a resource server: it validates tokens but never sees the user's password.

MCP clientOAuth clientMCP serverresource serverAuth serverissues tokens1. request (no token)2. 401 + WWW-Authenticateresource_metadata=…3. GET protected resource metadata/.well-known/oauth-protected-resource4. GET auth server metadata, register client5. authorize (PKCE, resource=…)User signs in and consents in the browser6. authorization code7. token request + code_verifier8. access token (audience = this server)9. MCP request + Bearer token
  • Discovery uses Protected Resource Metadata (RFC 9728) plus authorization server metadata, so there's no hard-coded config.
  • PKCE is required, so a stolen authorization code is useless on its own.
  • Resource indicators (RFC 8707) bind each token to one server, so it can't be replayed elsewhere.
  • stdio servers skip all of this and read credentials from their environment.

No token passthrough

A server must not forward the client's token to upstream APIs. If it calls GitHub, it needs its own GitHub credentials.
Authentication vs authorization, OAuth and OIDC each get a deck of their own in Security › Identity & Access.

25 / 28