Unverified60% confidenceSolutionExact time
In the OAuth flow, the MCP server returns a 401 Unauthorized response to requests without a valid token, along with a login URL pointing to the authorization server.
2
Sources
60%
Confidence
Long-term
Relevance
9/27/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedIn MCP over HTTP communication, when a client makes a call without a token, the server returns 401 Unauthorized.79% similarUnverifiedThe MCP server acts as an OAuth-protected resource and Entra ID as the authorization server; clients without a token receive an authentication challenge and discover the authorization metadata; the server must validate issuer, audience, validity period and scope or role; a token intended for a downstream API should not be automatically accepted as a token for accessing this MCP server.75% similarUnverifiedBoth OAuth and OpenID Connect assume that the MCP client has already been registered with the server or authorization server.72% similarUnverifiedWhen calling an MCP server that uses the Streamable HTTP transport, the HTTP request's Accept header must include both application/json and text/event-stream, otherwise the server returns 406.70% similarUnverifiedAn MCP server may only accept tokens issued for itself and must not forward client tokens to another API, as doing so would create a Confused Deputy vulnerability.70% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/953115API
curl https://kongchang.com/api/v1/knowledge/claims/953115MCP
get_claim(id=953115)