Verified65% confidenceFactExact time
Every protected MCP server must publish a JSON document located at /.well-known/oauth-protected-resource, declaring the server's identity, supported permission scopes, and the authorization servers qualified to issue tokens.
3
Sources
65%
Confidence
Long-term
Relevance
10/10/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe MCP server acts as an OAuth-protected resource and Entra ID as the authorization server; clients without a token receive an authentication challenge and discover the authorization metadata; the server must validate issuer, audience, validity period and scope or role; a token intended for a downstream API should not be automatically accepted as a token for accessing this MCP server.78% similarUnverifiedThe MCP specification requires that tool annotations be treated as untrusted unless the server is trusted.77% similarVerifiedMCP采用客户端-服务器架构，基于标准化的JSON-RPC通信协议74% similarUnverifiedThe confused deputy problem is one of the MCP security risks: an MCP Server holding broad credentials performs operations on behalf of a user who should not have that permission.73% similarVerifiedIn MCP's security design, tool invocations are stipulated to require explicit user authorization, and resource access is constrained by permission boundaries.73% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/994258API
curl https://kongchang.com/api/v1/knowledge/claims/994258MCP
get_claim(id=994258)