There is a common criticism — “MCP has no authentication” — that used to be true and no longer is. The specification defines an authorization model. The problem shifted from “it does not exist” to “it exists and almost nobody implements it”, which is a different and more tractable problem.
The model, in three obligations
The June 2025 revision reclassified the MCP server as a pure OAuth resource server — it does not authenticate users, does not issue tokens, does not manage login. Three tasks remain:
- Answer 401 with a
WWW-Authenticateheader pointing at the protected resource metadata document. - Publish that document per RFC 9728, naming which authorization server it trusts and which scopes exist.
- Reject every token not issued for it — audience validation. This is the only genuinely critical item and the one most often skipped.
The client acts as an OAuth 2.1 client, with PKCE mandatory using S256, and discovers the authorization server through the metadata chain. Later revisions tightened issuer validation and client registration.
The distance between spec and reality
Astrix's audit of more than 5,200 servers found 88% requiring credentials of some kind, 53% relying on static keys or personal access tokens, and only 8.5% using OAuth. Seventy-nine per cent passed keys through environment variables.
This is not a specification gap. It is an adoption gap — which is exactly where a security function has something to do.
What to do when you cannot rewrite the server
Much of what runs in production is third-party code you do not control. Treat it as a legacy service without authentication — a problem the industry already solved:
- Put a gateway in front doing token validation and mTLS termination, and restrict the server to accept connections only from the gateway.
- Swap static keys for short-lived credentials wherever the destination service allows it.
- Get the secret out of the environment variable and inject it through a mounted file with restrictive permissions or a secrets provider — environment variables leak in process dumps, crash logs and any tool that lists the environment.
- If the server does not validate audience, make sure it only ever receives tokens from a single issuer, and that this issuer serves no other audience.
None of these measures is new. They are the same playbook for putting an old internal service behind modern control — applied to a component the organisation has not yet classified as a service.
