MCP Authentication and Authorization Patterns

This MCP Security Best Practices specification mandates strict, non-optional authentication and authorization controls for systems composed of nonhuman identities (agents, servers, tools) to prevent confused deputy attacks: it requires OAuth 2.1 (Authorization Code with PKCE and Client Credentials), short-lived and aud-validated tokens, forbids session-based authentication and token passthrough, prescribes mTLS and federated identity for high-security or cross-cloud use, enforces five mandatory authorization patterns (per-client consent, audience validation, no token passthrough, exact redirect URI matching, and cryptographic state validation), and mandates TLS-enforced transport plus context-aware conditional access and auditing for large-scale deployments.