mcp-authorizationlisted

# MCP Authorization ## Purpose The MCP 2026-07-28 spec aligns authorization with production **OAuth 2.1 and OIDC**, so a remote MCP server plugs into enterprise identity (Microsoft Entra, Okta, Auth0, Keycloak) without custom workarounds. The model is simple to state and easy to get dangerously wrong: the **MCP server is an OAuth 2.1 resource server**. It does not mint tokens and it does not log users in; it **validates** an access token on every request and serves only what that token authorizes. This skill covers correct validation and the two highest-severity anti-patterns, token passthrough and the confused deputy. (stdio/local servers do not use OAuth, skip this for them.) ## The roles | Role | Who | Responsibility | |---|---|---| | Authorization server (AS) | Entra / Okta / Auth0 / your IdP | authenticates the user, issues access tokens | | Resource server (RS) | **your MCP server** | validates the token, enforces scope, serves tools | | Client | Claude Code / the host app | obtains a token from the AS, sends it to the RS | Your job is the RS. You never see the user's password; you receive a bearer access token and must prove it is valid **and minted for you**. ## Validate every token, every request On each request, verify (see `references/token-validation.md` for code): - **Signature** against the AS's published JWKS (cache keys, honor rotation). - **Issuer** (`iss`) equals your trusted AS. - **Audience** (`aud`) equals **this MCP server's** identifier. This is the