Skip to main content
VerifiedStandard or protocol

Model Context Protocol authorization

The authorization section of the Model Context Protocol is the closest thing agent tooling has to a settled access rule. An MCP server is an OAuth resource server, a client is an OAuth client, and a token must be issued for the server it is presented to. The specification is explicit that a server must not accept or transit any other token.

The verdict

Verified

The document exists. The ledger fetched it at its publisher and quotes it.

Key facts

What the sources say

Record ID
AAL-2026-0004
Kind
Standard or protocol
Jurisdiction
Global
Last verified
Added
  • Authorization servers must implement OAuth 2.1 with appropriate security measures for both confidential and public clients.
  • MCP servers must implement OAuth 2.0 Protected Resource Metadata (RFC 9728) and clients must use it for authorization server discovery.
  • MCP clients must implement Resource Indicators for OAuth 2.0 (RFC 8707) and must send the resource parameter in both authorization and token requests.
  • MCP servers must validate that access tokens were issued specifically for them as the intended audience, and must not accept or transit any other tokens.
  • Authorization is optional for MCP implementations; a stdio server is told to take credentials from the environment instead.

Dimension by dimension

4 dimensions, each one stated, silent or open

Identity, Authorization, Limits, Delegation. Stated means the document you can open below says it; silent means the ledger read the document and it does not.

IdentityStated
The client is identified to the authorization server by a client id obtained through Client ID Metadata Documents, pre registration or dynamic registration.Model Context Protocol specification 2026-07-28, Authorization, primary source, 28 July 2026.
AuthorizationStated
Access is an OAuth access token bound by audience to one named MCP server, and a server must reject anything else.Model Context Protocol specification 2025-06-18, Authorization, primary source, 18 June 2025.
LimitsStated
Scope is the limit. Servers should name the scopes needed in the WWW-Authenticate challenge and clients should request only those, escalating through a step up flow.Model Context Protocol specification 2026-07-28, Authorization, primary source, 28 July 2026.
DelegationSilent
The specification carries a resource owner's authority to one client and one server. It defines no chain, so a sub agent's authority is outside it.Model Context Protocol specification 2026-07-28, Authorization, primary source, 28 July 2026.

What it changes

For a team deploying an agent

If your agent reaches tools over MCP, this is the clause your security review should cite. Two questions settle most of it: does every token your server accepts name your server in its audience, and does your client request the narrowest scope the server challenged for. A yes to both removes the two failure modes that produced the worst MCP incidents.

Sources

What this record was verified against

  1. Model Context Protocol specification 2025-06-18, AuthorizationPrimary · 18 June 2025
  2. Model Context Protocol specification 2026-07-28, AuthorizationPrimary · 28 July 2026

Related

Records that sit beside this one

Cite this record

Free to reuse under CC BY 4.0, with attribution. The record ID AAL-2026-0004 is permanent and is never reused.

In a sentence
According to the GAGE Agent Authority Ledger (as of 15 September 2026), model context protocol authorization.
APA
GAGE (Global Academy of Generative-AI Education). (2026). Model Context Protocol authorization. Agent Authority Ledger. Retrieved 15 September 2026, from https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0004-model-context-protocol-authorization
MLA
"Model Context Protocol authorization." Agent Authority Ledger, GAGE (Global Academy of Generative-AI Education), 15 September 2026, https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0004-model-context-protocol-authorization.
Chicago
GAGE (Global Academy of Generative-AI Education). "Model Context Protocol authorization." Agent Authority Ledger. Last modified 15 September 2026. https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0004-model-context-protocol-authorization.
Permalink
https://www.gage.academy/tools/agent-authority-ledger/records/AAL-2026-0004-model-context-protocol-authorization

Last updated . Every record re verified . The ledger is checked weekly, every Monday, and the same day for any NIST, IETF or MCP publication.

Back to the full ledger, or every record for Global and every standard or protocol record.

GAGE briefings tell you which AI regulation deadlines are coming, what they actually require of you, and when a program opens.

Powered by GAGE, free EU AI Act tools from the Global Academy of Generative-AI Education
CallEmailHelp