OAuth 2.1 for MCP
Also called: MCP authorization
The authorization framework MCP adopted for HTTP servers, based on OAuth 2.1 with PKCE, dynamic client registration, and protected-resource metadata.
MCP's HTTP transport originally shipped without a standard auth story; 2025 spec revisions added one. It treats the MCP server as an OAuth protected resource, requires PKCE, supports discovering the authorization server via metadata, and allows dynamic client registration so clients and servers that have never met can establish trust. Later revisions separated the roles of resource server and authorization server more cleanly.
Why it matters
Getting agent authorization right is hard and the spec has moved quickly, so real deployments vary widely in which revision they implement. Known trouble spots: token audience validation (see token passthrough), the security of dynamic client registration, and consent screens that users don't understand. An MCP server's auth posture is a large part of its exposure.
Exposure map
Live counts of instances showing this pattern will appear here once the exposure map is collecting data.