Model Context Protocol (MCP) Security · Authentication & Authorization
Bind client credentials to their issuer
Verify that MCP clients bind persisted OAuth client credentials to the issuing authorization server and do not present them to a different authorization server.
OWASP AISVS v1.01, requirement 10.2.9
In plain English
An MCP client that saves OAuth client credentials must remember which authorisation server issued them and use them only there. Otherwise a malicious MCP server can point the client at an authorisation server it controls and collect credentials meant for somewhere else.
What good looks like
- Stored client credentials are recorded together with the issuer that granted them.
- Before presenting credentials, the client checks that the authorisation server matches that issuer.
- A mismatch is refused and logged.
- Tests cover a server that changes its advertised authorisation server.
How teams usually do it
- Key the credential store by issuer identifier and look credentials up by the issuer of the current flow.
- Validate authorisation server metadata, including that the issuer value matches where the metadata was fetched from (RFC 8414).
- Treat a change of authorisation server for a known MCP server as a reason to ask the user again.
Suggested evidence
- Client code showing the binding.
- A test where a different issuer asks for the stored credentials and is refused.
Common mistakes
- One stored client secret presented to whichever server asks.
- Keying stored credentials by MCP server URL alone, when the server chooses which authorisation server to name.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.