OAuth 2.1
A modernized consolidation of the classic OAuth 2.0 authorization framework, being standardized by the IETF. It mandates the use of PKCE, disables implicit grant flows, and enforces strict redirect_uri validation, serving as a security foundation for AI agent device-control scenarios.
Core Facts
MCP's permission model draws on the OAuth 2.0 authorization code flow, requiring explicit user authorization for tool invocation.
The MCP specification recommends using OAuth 2.1 to protect remote Servers.
PKCE is a security extension in OAuth 2.1 designed for public clients, where the client submits a hash of the code verifier and must include the original verifier when exchanging for a token, making it impossible to redeem the token even if the authorization code is intercepted.
Timeline (last 90 days)
The MCP specification recommends using OAuth 2.1 to protect remote Servers.
The MCP authorization specification in the 2025-06-18 revision requires implementing OAuth 2.1 (draft-ietf-oauth-v2-1-13), RFC 9728 protected resource metadata, and RFC 8414 authorization server metadata, and achieves audience binding through RFC 8707.
An MCP server may only accept tokens issued for itself and must not forward client tokens to another API, as doing so would create a Confused Deputy vulnerability.
Anthropic is advancing native OAuth 2.1 support in the MCP protocol.
The authentication scheme recommended by the official MCP specification is OAuth 2.1 with PKCE.
PKCE is a security extension in OAuth 2.1 designed for public clients, where the client submits a hash of the code verifier and must include the original verifier when exchanging for a token, making it impossible to redeem the token even if the authorization code is intercepted.
OAuth 2.1 is a security-hardened version of OAuth 2.0 that mandates the use of PKCE and deprecates several insecure authorization flows.
OAuth 2.1 is a security-hardened version of the OAuth 2.0 authorization framework that mandates the use of PKCE to prevent authorization code interception attacks.
PKCE is an important security enhancement in OAuth 2.1 compared to 2.0, defending against authorization code interception attacks through a paired verification mechanism of code_verifier and code_challenge.
OAuth 2.0 is an authorization framework that implements identity authentication in conjunction with the OIDC extension.
3 more timeline events
All Facts (16)
MCP's permission model draws on the OAuth 2.0 authorization code flow, requiring explicit user authorization for tool invocation.
75%VerifiedThe MCP specification recommends using OAuth 2.1 to protect remote Servers.
65%VerifiedPKCE is a security extension in OAuth 2.1 designed for public clients, where the client submits a hash of the code verifier and must include the original verifier when exchanging for a token, making it impossible to redeem the token even if the authorization code is intercepted.
65%VerifiedOAuth 2.0 is an authorization framework that implements identity authentication in conjunction with the OIDC extension.
65%Partially VerifiedMCP对外公网服务支持基于OAuth 2.1授权框架和JWT的Token认证机制
65%UnverifiedThe authentication scheme recommended by the official MCP specification is OAuth 2.1 with PKCE.
60%UnverifiedOAuth 2.1 mandates the use of PKCE (Proof Key for Code Exchange) to prevent authorization code interception attacks.
60%UnverifiedThe PKCE (Proof Key for Code Exchange) extension prevents the Authorization Code from being hijacked and abused by generating a random code_verifier and verifying its hash value.
60%UnverifiedThe MCP authorization specification in the 2025-06-18 revision requires implementing OAuth 2.1 (draft-ietf-oauth-v2-1-13), RFC 9728 protected resource metadata, and RFC 8414 authorization server metadata, and achieves audience binding through RFC 8707.
50%UnverifiedAn MCP server may only accept tokens issued for itself and must not forward client tokens to another API, as doing so would create a Confused Deputy vulnerability.
50%UnverifiedAnthropic is advancing native OAuth 2.1 support in the MCP protocol.
50%UnverifiedOAuth 2.1 is a security-hardened version of OAuth 2.0 that mandates the use of PKCE and deprecates several insecure authorization flows.
50%UnverifiedOAuth 2.1 is a security-hardened version of the OAuth 2.0 authorization framework that mandates the use of PKCE to prevent authorization code interception attacks.
50%UnverifiedPKCE is an important security enhancement in OAuth 2.1 compared to 2.0, defending against authorization code interception attacks through a paired verification mechanism of code_verifier and code_challenge.
50%UnverifiedThe OAuth 2.1 draft upgrades PKCE from optional to mandatory and prohibits implicit grants and resource owner password credential grants.
50%UnverifiedRemote MCP Servers are required to implement the OAuth 2.1 authentication flow, which mandates the use of PKCE to prevent authorization code interception attacks and disables implicit grants.
50%