Define transport and execution location
A STDIO server runs as a local process; an HTTP server is reached at an address. MCP’s authorization specification covers HTTP. For STDIO it instead describes credentials supplied through the environment. This does not justify broad process access. Record who starts the process, which environment it receives and which files or services it can reach.
Enforce authentication at the correct boundary
For a protected HTTP server, review its authorization flow and tokens issued for that server. Do not simply accept or pass through tokens intended for another service. The downstream application has its own permissions. Successful login is therefore only part of the evidence: the actual tool call must also fit the authorised scope.
Test allowed access, denial and revocation
Start with a search function rather than unrestricted administration. Test valid input, invalid parameters, missing permissions and revoked access. Errors must not expose keys or unnecessary source data. Give the operator concise documentation of version, updates and shutdown. A successful connection alone is not operational acceptance.
Decision matrix
| Decision point | Proceed when | Stop when |
|---|---|---|
| Access and data path | Documented: minimal tools, clear schemas, authentication, logging and tests. | Scope, data or accountability remains unresolved. |
| Connection under test | Acceptance demonstrates an allowed tool call, a denied unauthorised request and effective revocation in the chosen transport. Error output contains no secrets. | There is only an unevaluated demo without acceptance evidence. |
| External effect | Owner, approval, fallback and next review date are defined. | Avoid: universal tool rights and unfiltered errors. A server with universal permissions or unfiltered errors is not sufficiently bounded merely because a connection succeeds. |
Keep it verifiable
Primary sources
- Model Context Protocol: Authorization 2026-07-28Source checked:
- Model Context Protocol: Authorization security considerationsSource checked:
- OpenAI: Model Context ProtocolSource checked:
