Client · Authorization
PKCE on every authorization request
The client generates a PKCE verifier and S256 challenge for every authorization request and refuses to proceed when the server does not advertise S256.
mcp.client.pkce
In revision 2026-07-28
- Level
- MUST
- Defined in
- Security Considerations › Authorization Code ProtectionMCP Authorization 2026-07-28
- Party
- Client
- Observable
manualRequires reading documentation or source; recorded by people.
Client-side requirement: not shown in the server matrix. It is recorded so later tools can cite it.
Level by revision
| Revision | Level | Section |
|---|---|---|
| 2026-07-28current | MUST | Security Considerations › Authorization Code Protection |
| 2025-11-25 | MUST | Security Considerations › Authorization Code Protection |