createmcps.com

MCP-AUT-008

Tokens with a foreign audience are rejected

“MCP servers MUST validate that access tokens were issued specifically for them as the intended audience, according to RFC 8707 Section 2.” — spec anchor

How to fix this

Validate the access token's audience against this server's own canonical resource URI (RFC 8707 §2), and reject any token issued for a different resource. Accepting one is the confused-deputy risk this check exists to catch.

Example: failing and passing

The server accepts a token whose audience is a different service and serves the request.
Violates MCP-AUT-008 · HTTP
POST /mcp HTTP/1.1
Host: mcp.example.com
Authorization: Bearer <token issued for https://api.other.example>
Mcp-Method: tools/list
...

HTTP/1.1 200 OK
Content-Type: application/json
...
The server sees that the token was not issued for https://mcp.example.com/mcp and rejects it with 401 invalid_token.
Complies with MCP-AUT-008 · HTTP
POST /mcp HTTP/1.1
Host: mcp.example.com
Authorization: Bearer <token issued for https://api.other.example>
Mcp-Method: tools/list
...

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer error="invalid_token",
                         resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource"

How the validator checks this

Probe P8.1, against a streamable-http server on the modern protocol. What it reports:

skip
No authorization, so token audience validation does not apply

Quoted from the probe that runs this check, so it cannot drift from what the validator actually reports.

This rule is checked heuristically: a fail is inferred rather than certain, so it bumps the overall grade up one level instead of being treated as certain non-compliance.

Checked in the same request as MCP-AUT-001, MCP-AUT-006, MCP-AUT-007, MCP-SEC-007.

Check your own server against MCP-AUT-008

Probe P8.1 checks MCP-AUT-008 in the same request as 4 other rules, so one run shows your server's result for this rule next to the rest. Validate a server or read how the validator works.

Background on this topic: how to add OAuth to an MCP server.

Other Authorization rules

  • MCP-AUT-001Unauthenticated request returns 401 with WWW-Authenticate resource_metadata
  • MCP-AUT-002RFC 9728 Protected Resource Metadata is served and valid
  • MCP-AUT-003PRM resource equals the canonical server URI
  • MCP-AUT-004Each listed authorization server exposes RFC 8414 or OIDC discovery metadata
  • MCP-AUT-005AS advertises authorization_response_iss_parameter_supported: true
  • MCP-AUT-006WWW-Authenticate includes a scope parameter
  • MCP-AUT-007Insufficient scope returns 403 with error="insufficient_scope"
  • MCP-AUT-009offline_access absent from scopes_supported / challenge scope
  • MCP-AUT-010AS advertises S256 in code_challenge_methods_supported
  • MCP-AUT-011AS supports Client ID Metadata Documents, not DCR alone