Authentication, Authorization, and OAuth

Authentication versus authorization

• Authentication: Who is the caller?
• Authorization: What is the caller allowed to do?

For local stdio, the operating system/process boundary and configuration are important. Remote MCP servers generally operate as protected resources, and the current authorization specification defines OAuth-based discovery and token usage.

Rules

• Do not send bearer tokens in query strings.
• Validate that the token is intended for the correct audience/resource.
• Use short-lived, least-privilege scopes.
• Derive the tenant/user from server-side identity.
• Enforce authorization on every record-level access.
• Show a clear preview and obtain human approval before sensitive writes.

Confused-deputy risk

The server may possess a powerful upstream credential. If it accesses a caller-controlled resource without policy validation, the server can become an attacker's deputy. Tenant mapping, audience checks, explicit scopes, and resource ownership checks reduce this risk.