Unverified50% confidenceFactExact time
The 2026-07-28 version of the MCP authorization specification requires: clients must include resource in authorization requests and token requests (RFC 8707), servers must verify that a token was issued for themselves and otherwise return 401, clients must record the issuer obtained from verified authorization server metadata before redirecting and check the iss returned in the redirect (RFC 9207), and PKCE permits only S256.
1
Sources
50%
Confidence
Long-term
Relevance
10/18/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedWhen a client calls a protected MCP server without a token, it receives 401 Unauthorized, and the response header indicates the resource metadata link and the required scope.75% similarUnverifiedmcp-server-fetch rejects private addresses, loopback addresses, and metadata addresses by default as an SSRF protection measure.65% similarUnverifiedThe specification corresponding to DCR (Dynamic Client Registration) is RFC 7591; after the client sends a POST request to the authorization server's registration endpoint, the server returns a client ID and client secret.65% similarUnverifiedGNAP requires the client to prove possession of the corresponding private key (typically Ed25519) via HTTP message signatures on every request, and the resource server only needs to complete signature verification locally without any database query or network call.64% similarUnverifiedA registry/whitelist mechanism works by maintaining a pre-established list of fingerprints or public keys for known legitimate MCP servers, allowing only servers on the list to pass.63% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1063088API
curl https://kongchang.com/api/v1/knowledge/claims/1063088MCP
get_claim(id=1063088)