How Does Authentication Work in MCP?

📘 Two questions, answered separately

Authentication in MCP is two questions that tend to be answered in one breath, and separating them is most of the work. The first: which callers will this server answer? The second: whose credentials does the server use when it reaches the system behind it? The protocol is concerned with the first. The second is the operator’s, and it never appears in the protocol conversation at all.

Where the first question is answered depends on how the connection is made. When a host launches a server as a local subprocess, the connection is a private channel between two processes on one machine and the server runs with the privileges of the account that started it; the operating-system account is the boundary, and there is usually nothing separate to authenticate. Over a network that inheritance disappears, and the server must decide for each request whether the caller is one it answers.

For network connections the credential travels at the transport layer rather than inside the protocol messages — an HTTP request carries it the way it carries any other authorization — so a networked MCP server is authorized much as any other HTTP service is, and the specification describes how rather than inventing a scheme of its own. The consequence worth carrying away is blunt: a server reachable over a network with that decision unmade is reachable by anything that can route to it.

One rule follows from the arrangement and deserves stating on its own, because getting it wrong is how a server becomes a route into something else. A token presented to a server is evaluated by that server, for that server. A credential issued for some other party — the system behind it, or a third service an operation will call — is not proof of anything in this conversation, and forwarding a caller’s token onward as though the caller were making the downstream call merges two authorisation decisions that were meant to be taken separately. The caller establishes who it is to the server. What the server may then do is a question the server answers with its own credentials.

🧩 Three identities that get conflated

The person at the keyboard, the application making the call, and the server’s own standing with the system behind it are three different things, and the exchange carries the second of them at most. A server that has authenticated a caller knows which application connected. It does not thereby know who was using that application: that would have to be sent deliberately, as ordinary content, and content is an assertion rather than a credential no matter how plausible it looks on arrival.

The third identity is the one an audit trail usually wants. When an operation writes something, the write happens with the server’s own access, so the record downstream says the server did it. Carrying through who asked for it is work somebody has to do inside the operation, on purpose, and nothing in the protocol does it on their behalf.

📐 Where the downstream credentials stay

The second question stays on the server for the whole of its life. Whatever it needs to reach the system it fronts — a database password, an API key, a service account — is held server-side, used when an operation executes, and forms no part of what a caller sees or of what any conversation contains.

⚙️ How the Registry classifies requiring a credential

Configuring a server to require a token from every caller and to refuse the rest is a change to a running integration, which the code modification class covers. On the order form's task class field, select Code modification, which covers writing, editing, refactoring, and testing code. That class has its own page at /tasks/code.

The Registry files this topic under one canonical task, fixed in advance and published here rather than generated per visit:

Configure an MCP server to require an access token from every caller and to reject unauthenticated connections.

That string, hashed once, is c4c0bc359294c606… — the first sixteen of sixty-four hex characters. An assessment ordered against a task of this kind is computed from the class, the wording submitted, and the permanent chart the Registry derives for the model configuration named on the order: its ascendant, its ruling planet, and the composite harmony that constrains the range of verdicts available to it. The whole derivation is published at /method.

The risk in this work is a boundary assumed rather than configured: a server that inherited its safety from being local, and kept the assumption after it stopped being local. 4 risk factors are tracked for code modification tasks generally; an assessment reports 3 of them, selected by the submitted task's own seed rather than chosen. Their names, severities and descriptions are certificate content and are not published on a free page.

Get Assessment

📏 What this page does not claim

The Registry makes no representation that an assessment predicts the outcome of any task, and no assessment is validated against real-world results.

This page defines a term and states a classification. It publishes no verdict: the Registry does not test implementations, does not measure how often anything works, and has never run the canonical task above against any model. Which credential a deployment uses, who issues it, and how it is rotated are decisions the canonical brief leaves entirely open.

What is sold is a permanent, numbered assessment for one submitted task at one model configuration — a verdict on a seven-point scale, a recommended execution window, and, above the first tier, the risk factors the class tracks. EUR 1.90 Standard, EUR 4.90 Extended, and EUR 14.90 Full Chart, which adds the permanent chart for the configuration itself. Assessments from EUR 1.90; machine-readable at /pricing.json.

🔗 Related surfaces

← All MCP topics · The AFR-1 method · Code modification task class

Related topics: Security considerations · Remote servers · MCP server

❓ Questions about authentication

Does MCP define its own authentication scheme?

For network connections the credential is carried by the transport, the way an HTTP request carries one, and the specification describes how rather than defining a new scheme. For a server launched locally as a subprocess, the operating-system account that started it is usually the boundary.

Where do the credentials for the underlying system live?

On the server. It holds whatever reaching that system requires and uses it when an operation runs. Those credentials are not part of the protocol conversation and are not sent anywhere by it.

What changes about authentication when a server stops being local?

The implicit boundary disappears. A local subprocess is reachable only by the process that launched it; a networked server is reachable by anything that can route to it, so the decision about which callers it answers has to be made explicitly.

Should a server accept a token that was issued for another service?

No. A credential presented to a server is evaluated by that server, for that server. Accepting one minted for somewhere else, or forwarding a caller’s token to the system behind the server as though the caller were making that call, collapses two authorisation decisions into one.