The Model Context Protocol (MCP) authorization model was fundamentally revised on July 28, 2026, adding mandatory issuer validation, issuer‑bound client credentials, and Client ID Metadata Documents. At the same time, a field audit revealed that just over one‑fifth of MCP access policies are either broken or missing, exposing a widespread gap in token governance.
What changed in MCP authorization
The protocol maintainers released a specification update that shifts the trust model from implicit token acceptance to explicit issuer verification. The new requirements include:
- Validation of the token issuer against a trusted list.
- Binding client credentials to a specific issuer, preventing token reuse across unrelated services.
- Use of Client ID Metadata Documents as the preferred registration artifact.
Separately, an internal review of MCP deployments found that more than 20 % of the examined access policies were either broken or absent. In most of those cases the server was authenticated with a personal token rather than a service account, and no rotation schedule or audit logs existed.
Why platform and security teams should care
Two facts from the source drive the risk profile:
- Across the MCP ecosystem, 88 % of servers need credentials, yet only 8.5 % actually use OAuth, meaning the majority rely on static API keys or personal access tokens.
- Static tokens are rarely rotated; one example cited a token that had been valid for years until manually revoked.
When a token is tied to an individual identity rather than a service identity, any tool that reuses that token inherits the full privilege set of the user. The Bob example illustrates a weekend‑built Slack bot that runs with an admin‑level key, silently accessing calendar, ticket, and reporting APIs. Because no logs were kept, the token’s activity is invisible until an incident occurs.
Practical implications for architecture and operations
Engineers should treat MCP integrations as privileged components and apply the same rigor used for other cloud APIs:
- Prefer service accounts over personal tokens. Service accounts can be scoped and rotated without impacting individual users.
- Define explicit scopes. The source notes that many tutorials request read, write, and admin permissions indiscriminately; limiting scopes reduces the blast radius of a compromised token.
- Implement rotation schedules. The audit found no documented rotation; a regular rotation policy (e.g., 30‑day cadence) mitigates long‑lived credential exposure.
- Enable logging of token usage. Without logs, operators cannot answer “what did this token touch?” – a gap highlighted by the Splunk CVE‑2026‑20205 incident.
- Validate issuer information. With the new spec, clients must verify the issuer field; failing to do so reverts to the pre‑update insecure model.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Start a focused inventory of every MCP server in your environment. For each instance, verify that:
- The access policy exists and matches the intended resource set.
- Authentication uses an issuer‑validated token, preferably an OAuth‑based service account.
- A rotation schedule and audit logs are in place.
Address any gaps before the next production rollout. Treat the spec change as a deadline for tightening token hygiene, not just a documentation update.
