MCP server · Delegation
No token passthrough to upstream APIs
The MCP server never forwards the client's access token to upstream APIs; it obtains its own credentials for downstream calls.
mcp.rs.no-passthrough
In revision 2026-07-28
- Level
- MUST
- Defined in
- Security Considerations › Access Token Privilege RestrictionMCP Authorization 2026-07-28
- Party
- MCP server
- Observable
manualRequires reading documentation or source; recorded by people.
Level by revision
| Revision | Level | Section |
|---|---|---|
| 2026-07-28current | MUST | Security Considerations › Access Token Privilege Restriction |
| 2025-11-25 | MUST | Security Considerations › Access Token Privilege Restriction |
Adoption across listed servers
- Supported0
- Partial1
- Unsupported0
- Unknown33
- Not applicable5