Authentication
A remote MCP URL without auth is an open admin panel. Anyone who finds it can query your database or send Slack messages.
Auth is the bouncer. A wristband (token) gets you in. VIP sections (write tools) need a different stamp (scope).
Visual Workflows
Start here — scroll inside each diagram frame to explore, then use + / − to zoom up to 200% if needed.
Overview
Scroll inside the frame to explore · use + / − to zoom up to 200%
Scroll inside the frame to explore · use + / − to zoom up to 200%
OAuth in one pass
Scroll inside the frame to explore · use + / − to zoom up to 200%
The human grants scopes. The client stores a token. Every MCP request carries it.
Key Takeaways
- 1.Local stdio servers usually skip network auth — the OS user is the gate. Remote servers need OAuth 2.1, API keys, or mTLS before any tool runs.
- 2.Scopes limit which tools a token may call (read vs write) Never put long-lived secrets in the prompt; put them on the server.
- 3.MCP can advertise authorization via .well-known endpoints. Map scopes onto tools: search_code might need repo:read; create_issue needs repo:write.
- 4.Fail closed if the token is missing.
Learn elsewhere
- →How HTTP carries the messages — Transport
- →Human approval for destructive tools — agent guardrails (other phases)
Real Example
Scenario
A GitHub MCP server asks for OAuth with repo:read. Until the user authorizes, search_code is hidden or returns 401 instead of leaking private code.
What you would do
In Model Context Protocol, apply Authentication to this scenario: A GitHub MCP server asks for OAuth with repo:read. Identify the inputs, run the technique, validate the output, and note one thing you would monitor in production.
Commands
Commands to Remember
Local = OS permissionsRemote = OAuth / API key / mTLSScopes map to toolsSecrets never belong in the LLM prompt
Cheat Sheet
Quick recap
quick ref- •No auth on a public URL is a breach
- •OAuth 2.1 for user-facing remote MCP
- •Least privilege scopes
- •Keep tokens off the prompt
Common Mistakes
- ✕Shipping a remote MCP URL with no login
- ✕One token that can do every write tool
- ✕Pasting API keys into the system prompt