An MCP client obtains a token for an MCP server

The chain, step by step

1. 1

   Step 1: Agent host → to Tasks MCP server

   POST /mcp (initialize) with no Authorization header

   The host has no token for this server yet, so it starts with the request any client makes first. Everything it learns about where to get a token comes from the answer.

   Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMCP Authorization 2026-07-28

2. 2

   Step 2: Tasks MCP server → to Agent host

   401 with WWW-Authenticate: Bearer resource_metadata="…/.well-known/oauth-protected-resource/mcp"

   The server must point at its protected resource metadata, either in this challenge or at the well-known location; this server does both.

   Authorization Server Discovery › Protected Resource Metadata Discovery RequirementsMCP Authorization 2026-07-28

3. 3

   Step 3: Agent host → to Tasks MCP server

   GET /.well-known/oauth-protected-resource/mcp

   3. Protected Resource MetadataOAuth 2.0 Protected Resource Metadata rfc

4. 4

   Step 4: Tasks MCP server → to Agent hostreplaces "prm"

   resource: https://mcp.tasks.example/mcp, authorization_servers: [an authorization server the attacker controls]

   Everything the client learns about where to authorize comes from this answer. A server reached over plain http, or one the person was tricked into adding, can say anything here.

   Authorization Server Discovery › Authorization Server LocationMCP Authorization 2026-07-28

5. 5

   Step 5: Agent host → to auth.tasks.example

   GET /.well-known/oauth-authorization-server

   3. Obtaining Authorization Server MetadataOAuth 2.0 Authorization Server Metadata rfc

6. 6

   Step 6: auth.tasks.example → to Agent hostreplaces "as-metadata"

   issuer, authorization_endpoint: <not an https URL>, token_endpoint, code_challenge_methods_supported: [S256]

   The specification requires every authorization server endpoint to be https. A client that checks this refuses the metadata here and the chain stops.

   Security Considerations › Communication SecurityMCP Authorization 2026-07-28

7. 7

   Step 7: Agent host → to Alexreplaces "authorization-request"

   Open the authorization_endpoint value on Alex's machine, unchecked, with the request parameters appended

   In the baseline this opens Alex's browser at the authorization server. Here the client acts on a value it never validated, on the machine the person is using.

   Security Considerations › Communication SecurityMCP Authorization 2026-07-28

8. 8

   Step 8: auth.tasks.example → to Alex

   Consent screen built from the fetched client metadata: name, redirect URI, requested scope

   The authorization server fetches the document at the client_id URL, checks that the redirect URI is one it lists, and shows Alex who is asking.

   Client Registration › Client ID Metadata DocumentsMCP Authorization 2026-07-28

9. 9

   Step 9: auth.tasks.example → to Agent host

   Redirect with code, state and iss=https://auth.tasks.example

   The client compares iss byte for byte with the issuer it discovered before it uses the code; a mismatch means the response came from somewhere else.

   Authorization › Authorization Response ValidationMCP Authorization 2026-07-28

10. 10

    Step 10: Agent host → to auth.tasks.example

    POST /token: grant_type=authorization_code, code, code_verifier, resource=https://mcp.tasks.example/mcp

    Security Considerations › Authorization Code ProtectionMCP Authorization 2026-07-28

11. 11

    Step 11: auth.tasks.example → to Agent host

    Access token bound to the tasks server

    The authorization server verified the code verifier against the challenge and issued a token whose audience is the resource the client asked for.

    Security Considerations › Token Audience Binding and ValidationMCP Authorization 2026-07-28

    Access token for the Tasks MCP servertyp at+jwt · alg ES256 · kid auth-2026-1

    iss

    https://auth.tasks.example

    sub

    alex

    aud

    https://mcp.tasks.example/mcp

    client_id

    https://agent.example/client.json

    scope

    tasks:read tasks:write

    exp

    1790000000

    iat

    1789996400

    jti

    7f2c

    Unchanged since the previous token in this chain. Shown in the RFC 9068 JWT profile; an opaque token would carry the same binding on the server side.

12. 12

    Step 12: Agent host → to Tasks MCP server

    POST /mcp (tools/call) with Authorization: Bearer <access token>

    Authorization › Access Token UsageMCP Authorization 2026-07-28

    Access token as presentedtyp at+jwt · alg ES256 · kid auth-2026-1

    iss

    https://auth.tasks.example

    sub

    alex

    aud

    https://mcp.tasks.example/mcp

    client_id

    https://agent.example/client.json

    scope

    tasks:read tasks:write

    exp

    1790000000

    iat

    1789996400

    jti

    7f2c

    Unchanged since the previous token in this chain.

13. 13

    Step 13: Tasks MCP server → to itself

    Validate signature, iss, exp and that aud is this server; check scope

    A token issued for another resource is rejected here, whoever presents it. This is the check the resource parameter exists for.

    Security Considerations › Token Audience Binding and ValidationMCP Authorization 2026-07-28

14. 14

    Step 14: Tasks MCP server → to Tasks API

    GET /tasks with a token the server obtained for the API (here by token exchange, acting for Alex)

    The server never forwards the token it received. It holds credentials of its own for the API and obtains a token whose audience is the API, so the API can tell who is calling on whose behalf.

    Security Considerations › Access Token Privilege RestrictionMCP Authorization 2026-07-28

    The server's own token for the Tasks APItyp at+jwt · alg ES256 · kid auth-2026-1

    iss

    https://auth.tasks.example

    sub

    alex

    audchanged

    https://api.tasks.example

    client_idchanged

    tasks-mcp-server

    scopechanged

    tasks:read

    actadded

    {
      "sub": "tasks-mcp-server"
    }

    expchanged

    1789999000

    iatchanged

    1789996500

    jtichanged

    9b10

    7 claims differ from the previous token in this chain.

15. 15

    Step 15: Tasks MCP server → to Agent host

    200 with the tool result

    Authorization › Access Token UsageMCP Authorization 2026-07-28