MCP Authentication — Patterns

Audience-bound credentials, verified on receipt

Problem. A credential that is merely valid can be replayed anywhere that accepts the same issuer. An application holding a token for one server can present it to another, and a compromised server can present the token it received to systems its caller never intended.

Approach. Request credentials for a named target, so the issued credential carries the identity of the resource it is for, and have every receiving server reject any credential whose intended audience is not itself — before looking at scopes, and without exception for internal callers. Never forward a received credential onward; where a downstream call is needed, exchange it for one issued for that downstream.

Trade-off. It multiplies tokens: a session touching five upstreams now holds five credentials with five renewal clocks. It also requires every participant to implement the check, and a single lenient server re-opens the hole for everyone behind it.

Discovery instead of pairwise configuration

Problem. When each client must be told, by hand, which authorisation server a given server trusts and which endpoints to use, onboarding is a ticket and a rotation is an outage. The configuration is also silently wrong for as long as nobody exercises it.

Approach. Have the protected resource publish, at a well-known location, which authorisation servers it accepts and what it requires, and have the authorisation server publish its own endpoints and supported parameters the same way. A client that receives a challenge follows it to the metadata, registers or selects a client identity, and completes the flow without a human editing a file.

Trade-off. Automatic discovery means a client will follow a pointer given to it by the resource, which is only safe if the resource itself is authenticated and the discovered authorisation server is checked against an allowlist. Metadata also becomes availability- critical and needs caching with a sane staleness policy.

Re-authorisation as a first-class conversational event

Problem. Credentials expire on a schedule that has nothing to do with conversation boundaries. Handling expiry as an ordinary tool failure produces a model that tries increasingly creative workarounds while the actual remedy — a human approving something — never gets requested.

Approach. Give expiry and revocation their own result type, distinct from both transport failure and business error, which the host intercepts before the model sees it. The host suspends the turn, surfaces a re-authorisation prompt to the user, and resumes the pending call on completion. The model is told the call is pending on the user, not that it failed.

Trade-off. Suspending and resuming a turn is real machinery: the pending call, its arguments, and the conversation state must be held somewhere for as long as the user takes. Unattended and batch sessions have no user to prompt and need a different path entirely, usually a service identity with its own, narrower grant.

Narrow the grant to the action, not the server

Problem. When consent is expressed per connection, the user approves the union of everything that server can do. Approving a server so it can summarise documents also lets it delete them, and the consent screen gave no indication of the difference.

Approach. Define consentable units at the granularity of what the user would recognise as a distinct capability, map each offering to the unit it requires, and refuse any call whose required unit is not in the presented credential. Where the identity provider cannot express this natively, encode the units in the scope naming convention and enforce them at the resource. Make the consent text name the data and the effect, not the integration.

Trade-off. Fine-grained consent means more prompts, and a user who is prompted often approves without reading — the same outcome as a coarse grant, reached more slowly. Grouping related units into a small number of meaningful bundles is usually the only workable compromise, and choosing the bundles is a judgement that has to be revisited as the surface grows.