One post tagged with "security"

Your MCP Server Must Refuse That Token

September 4, 2026 · 15 min read

MCP Developer & Educator

Series cover. A red row shows a client token passed straight through an MCP server to a third-party API across a trust boundary, marked wrong audience. A green row shows the client getting an audience-bound token from an auth server first. The strapline reads: issued for the MCP server, or refuse it.

You are wrapping a third-party API in an MCP server. The client that connects to you already holds an access token for that API, and it sends the token along. Your server has the token, the API wants the token, and there is a perfectly good Authorization header sitting right there.

Forward it. Ship it. Move on.

The MCP specification says otherwise, in the flattest language it uses anywhere: MCP servers MUST NOT accept any tokens that were not explicitly issued for the MCP server. Most of the security guidance in MCP is a SHOULD. This one is a MUST NOT, and it is worth understanding why the bar is set that high.