Model Context Protocol (MCP) Security · Authentication & Authorization
Accept only tokens issued for this server
Verify that MCP servers only accept tokens explicitly issued for them, and do not pass tokens issued for other services through to downstream APIs.
OWASP AISVS v1.01, requirement 10.2.7
In plain English
An MCP server should accept only tokens issued specifically for it, and should never forward a client's token to another API. Forwarding, known as token passthrough, hides who is really calling and lets a token be used in places it was never meant for. The MCP specification forbids it.
What good looks like
- Tokens whose audience is not this server are rejected.
- Calls to downstream APIs use separate tokens obtained for those APIs.
- The incoming token is never sent onward.
- Clients ask for tokens bound to the specific server, using resource indicators.
How teams usually do it
- Strict audience validation, with clients using OAuth resource indicators (RFC 8707) as the MCP authorisation specification requires.
- OAuth token exchange (RFC 8693) or the on-behalf-of flow to get a correctly scoped downstream token.
- A code search for places where the incoming Authorization header is copied to outbound requests.
Suggested evidence
- Tests showing tokens for other audiences are refused.
- Code showing how downstream tokens are obtained.
Common mistakes
- Passing the incoming token straight through to a backend API.
- A shared audience value across many services, so a token for one works on all.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.