MCP servers can access sensitive tools and data, so identity and permissions are central to secure implementation.
Earlier MCP specifications assumed that a server developer would operate an OAuth 2.0 authentication server. An April 2025 update allows MCP servers to delegate authentication to external identity providers such as Microsoft Entra ID. This reduces the need for every implementation to create its own identity service.
Token pass-through is explicitly identified as unsafe. In token pass-through, a client gives the MCP server a token intended for a downstream resource and the server forwards it. This can allow the client to bypass security controls, weaken the audit trail, and break trust boundaries between services.
The required approach is to accept tokens issued specifically for the MCP server. The server then controls how it interacts with the downstream resource.
Least privilege should be applied to every server. A server created to access sales information should not receive access to all enterprise files. Role-based access control should be used, roles should be audited, and permissions should be reviewed regularly.
The host also has a role in user control. Hosts manage permissions and can ask the user to approve a tool call or data access. In the examples, the user sees which tool the model wants to invoke and can allow it once.
Security controls also include authentication, rate limiting, logging, and monitoring. These controls help determine who can use a server, how much it can be used, and what actions have occurred.