Most MCP servers still skip OAuth. That is the whole security story.
The Model Context Protocol has had a very good eighteen months. Thousands of public servers, adoption in every major AI client, and a specification that now moves through an open process. The security picture is less flattering: the spec requires OAuth 2.1, and third-party surveys of public servers keep finding that only a small fraction actually implement it.
What the specification requires
OAuth 2.1, and as of the July 2026 revision, a noticeably harder version of it. Authorization servers should return the iss parameter per RFC 9207 and clients must validate it before redeeming a code, which closes an authorization-server mix-up attack. Client credentials are bound to the issuer that minted them, so they cannot be replayed against a different authorization server. And Client ID Metadata Documents are now the preferred registration path — Dynamic Client Registration is formally deprecated in favour of CIMD, though it keeps working for compatibility.
Why a buyer should care
- A server with no authentication that touches real data is an open endpoint with a friendly description.
- Credentials that are not issuer-bound are a confused-deputy problem waiting for someone to notice.
- Without per-seat identity there is no way to revoke one person's access — only everyone's.
- If a server cannot tell you who called a tool, it cannot tell you who leaked something either.
What we do
SuperCognit's MCP endpoint implements OAuth 2.1 including issuer validation and CIMD registration. Tools list without signing in, deliberately, so a prospective buyer can paste the URL and see exactly what a server offers before any credential changes hands; OAuth kicks in on the first actual tool call. That combination — inspectable without an account, authenticated before it does anything — is what we would want from somebody else's server.
If you are evaluating a server, the checklist is short: does it do OAuth at all, does it validate the issuer, can you revoke a single seat, and does it log who called what. A server that fails the first question does not need the other three.