MCP Authorization Conformance

Why this page exists. MCP makes tool connection easy. Enterprises need the missing authorization proof: which agent was delegated, which resource the token was minted for, which scopes were granted, and whether the tool call stayed inside the workflow.

The product bet

SecurityRecipes is positioned as the secure context layer for agentic AI. Context trust, egress controls, and run receipts are not enough if MCP authorization is loose. A production reviewer will ask:

  • Is the token bound to the MCP resource, not a generic upstream API?
  • Does the MCP server validate audience, issuer, expiry, and scope?
  • Are raw user tokens ever passed through to downstream tools?
  • Is the scope tied to workflow, namespace, access mode, agent, and run?
  • Was the OAuth client ID metadata document validated for this client?
  • Did the client satisfy an authoritative WWW-Authenticate scope challenge?
  • Is a typed step-up authorization receipt present for approval-required access?
  • Can the gateway prove consent, session binding, and audit correlation?
  • Which new MCP servers fail before promotion?

The MCP Authorization Conformance pack answers those questions in a machine-readable artifact and exposes a runtime evaluator for pre-call authorization decisions. Rechecked August 23, 2026: MCP 2026-07-28 is still current and stateless. There is no negotiation handshake. Each request carries protocol version and capabilities. Servers MUST implement server/discover. --session-id and kill_session here are local run identifiers and host-session kill switches, not Mcp-Session-Id. Session binding in this pack means OAuth and token-to-run binding. Streamable HTTP revisions through 2025-11-25 could assign that header; 2026-07-28 ignores it and does not mint session IDs.

Workflow at a glance

MCP Authorization Conformance workflow

Test an MCP client's OAuth, token, scope, resource, audience, metadata, and runtime authorization behavior.

mcp-governance

  1. Signal

    Capture the authorization profile

    Record client, server, transport, issuer, metadata, redirect mode, grant, resource, scopes, audience, and environment.

  2. Scope

    Validate protocol evidence

    Check HTTPS metadata, PKCE/state, client registration, token binding/storage, refresh, expiration, audience, and resource indicators.

  3. Decision

    Evaluate a runtime request

    Bind identity, token claims, workflow, tool/resource, arguments, tenant, entitlement, approval, and policy.

  4. Action

    Enforce authorization

    Allow, narrow scope, require approval, hold, deny, revoke, or kill on token passthrough or credential misuse.

  5. Proof

    Publish conformance evidence

    Record cases, observed behavior, reason codes, token-safe metadata, exceptions, owners, and remediation.

Decision gate

Does the implementation and request satisfy required OAuth/MCP authorization controls for this resource and action?

Proceed

Authorize only the exact approved scope and resource.

Hold or stop

Hold, deny, revoke, or kill invalid, overbroad, replayed, passthrough, or mis-audienced authorization.

Evidence to retain

  • authorization profile and cases
  • runtime claim/scope decision
  • conformance results and exceptions

Expected outputs

  • authorization conformance pack
  • runtime auth decision
  • remediation backlog

What was added

  • Source profile: data/assurance/mcp-authorization-conformance-profile.json
  • Generator: scripts/generate_mcp_authorization_conformance_pack.py
  • Evidence pack: data/evidence/mcp-authorization-conformance-pack.json
  • Runtime evaluator: scripts/evaluate_mcp_authorization_decision.py
  • MCP tools: recipes_mcp_authorization_conformance_pack, paired with recipes_playbook_plan using playbook id mcp-authorization-conformance.

Regenerate and validate the pack:

python3 scripts/generate_mcp_authorization_conformance_pack.py
python3 scripts/generate_mcp_authorization_conformance_pack.py --check

Evaluate a runtime authorization request:

python3 scripts/evaluate_mcp_authorization_decision.py \
  --workflow-id vulnerable-dependency-remediation \
  --connector-id repository-contents \
  --namespace repo.contents \
  --agent-id sr-agent::vulnerable-dependency-remediation::codex \
  --run-id ci-allow \
  --client-id https://agent.security-recipes.ai/client-metadata/codex.json \
  --client-metadata-document-url https://agent.security-recipes.ai/client-metadata/codex.json \
  --client-metadata-document-validated \
  --authorization-server-discovery-method www_authenticate \
  --protected-resource-metadata-url https://mcp.security-recipes.ai/.well-known/oauth-protected-resource \
  --requested-access-mode write_branch \
  --resource-indicator https://mcp.security-recipes.ai/mcp \
  --token-audience https://mcp.security-recipes.ai/mcp \
  --token-issuer https://auth.security-recipes.ai \
  --token-expires-at 2099-01-01T00:15:00Z \
  --token-scope repo.contents:write_branch \
  --scope-challenge repo.contents:write_branch \
  --consent-record-id consent-ci \
  --session-id session-ci \
  --correlation-id corr-ci \
  --gateway-policy-hash sha256:ci-policy \
  --expect-decision allow_authorized_mcp_request

Decision model

Decision Meaning
allow_authorized_mcp_request The request is bound to the expected MCP resource and stays inside the connector and workflow scope.
hold_for_authorization_evidence The connector or candidate server still needs authorization metadata, gateway evidence, or conformance controls.
hold_for_client_metadata_evidence The remote MCP request lacks a validated HTTPS OAuth client ID metadata document that matches client_id.
hold_for_step_up_authorization Approval-required MCP access lacks a typed step-up authorization receipt.
deny_token_passthrough The request would pass raw user or upstream tokens through the agent/tool path.
deny_unbound_token The token is missing the expected resource indicator or audience binding.
deny_scope_challenge_mismatch The token scopes do not satisfy the authoritative MCP scope challenge for the resource.
deny_scope_drift The workflow, namespace, connector, or access mode is outside the approved authorization scope.
kill_session_on_secret_or_signer_scope The request includes credential, signer, deploy, publish, or live-funds authority.

What the pack proves

The generated pack joins:

  • the MCP connector trust pack,
  • the MCP connector intake pack,
  • the workflow control plane,
  • the gateway policy pack,
  • and the authorization conformance profile.

For production connector namespaces, it records the gateway attestation controls that must exist: per-client consent, short-lived workload identity, token-passthrough denial, audit, session binding, and write or approval controls where applicable.

For the latest MCP authorization revision, it also records the metadata evidence a production gateway should retain: protected-resource metadata discovery, authorization-server discovery, client ID metadata document validation, resource indicator and audience values, JWKS or introspection validation, redirect policy, scope challenge policy, and step-up authorization policy.

For candidate MCP servers, it evaluates the detailed intake profile for resource indicators, audience validation, PKCE, short-lived tokens, client ID metadata documents, scope challenge handling, step-up authorization, private-network exposure, token passthrough, session binding, and audit evidence before promotion.

Industry alignment

This feature follows current primary guidance:

Trusted-source path

The open pack is the proof model. The reviewed production opportunity is a hosted MCP authorization scanner:

  • discover live protected-resource and authorization-server metadata,
  • validate OAuth client ID metadata documents,
  • diff resource indicators, audiences, scopes, and redirect policy,
  • alert on scope challenge drift and token-passthrough regressions,
  • enforce step-up authorization receipts for approval-required calls,
  • replay confused-deputy and unbound-token tests,
  • attach signed authorization receipts to agent run receipts,
  • export fleet-wide evidence for AI platform review and procurement.

That is the path from open knowledge to a production MCP security platform that a model provider, AI platform vendor, or security company would understand.

MCP examples

Inspect the overall pack:

recipes_mcp_authorization_conformance_pack()

Review one connector:

recipes_mcp_authorization_conformance_pack(
  connector_id="repository-contents"
)

Plan one runtime request:

recipes_playbook_plan(
  playbook_id="mcp-authorization-conformance",
  finding="Repository-write MCP request needs OAuth and authorization conformance review."
)

See also