Is That Allowed? Authentication and Authorization in Model Context Protocol

Authentication and authorization’s current status

Model Context Protocol (MCP), released in late 2024, is an emerging standard for communication between AI agents and services, enabling exposure of functionality to diverse agents. Authentication in MCP currently occurs at the transport layer, utilizing either Standard Input/Output (stdio) or Streamable HTTP.

Why This Matters

Idealized models of AI agent interaction often assume secure, permissioned access to tools and data. In reality, securing these interactions is paramount; a compromised MCP server could grant unauthorized access to sensitive resources, leading to data breaches or malicious actions. The cost of failing to address these security concerns could range from reputational damage to significant financial losses.

Key Insights

• OAuth 2.1 adoption: MCP utilizes OAuth 2.1 for authentication with the Streamable HTTP transport, introduced in the 2025-06-18 specification.
• Scope Management: Defining granular scopes (e.g., mcp:read, mcp:write) is crucial for limiting an agent’s access to only necessary functionalities.
• Token Exchange: For downstream services, Token Exchange is recommended to propagate authentication context from the client to backend systems.

Working Example

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://resource.example.com/.well-known/oauth-protected-resource"

{
"resource":
"https://resource.example.com",
"authorization_servers":
["https://as1.example.com",
"https://as2.example.net"],
"bearer_methods_supported":
["header", "body"],
"scopes_supported":
["profile", "email", "phone"],
"resource_documentation":
"https://resource.example.com/resource_documentation.html"
}

Practical Applications

• AI-Powered Customer Support: A chatbot using MCP to access a CRM system would require appropriate scopes to view customer data but not modify it.
• Pitfall: Failing to validate access tokens on the MCP server can allow unauthorized agents to execute actions, potentially leading to data corruption or security breaches.

References:

• https://stackoverflow.blog/2026/01/21/is-that-allowed-authentication-and-authorization-in-model-context-protocol/