Skip to content

Commit 7eaf9a9

Browse files
authored
Merge branch 'pcarleton-security-considerations' into pcarleton/token-validation
2 parents 626b8bc + b7909f9 commit 7eaf9a9

File tree

8 files changed

+3597
-40
lines changed

8 files changed

+3597
-40
lines changed

docs/clients.mdx

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,12 +25,15 @@ This page provides an overview of applications that support the Model Context Pr
2525
| [Genkit][Genkit] | ⚠️ ||||| Supports resource list and lookup through tools. |
2626
| [GenAIScript][GenAIScript] |||||| Supports tools. |
2727
| [Goose][Goose] |||||| Supports tools. |
28+
| [gptme][gptme] |||||| Supports tools. |
2829
| [Klavis AI Slack/Discord/Web][Klavis AI] |||||| Supports tools and resources. |
2930
| [LibreChat][LibreChat] |||||| Supports tools for Agents |
31+
| [Lutra][Lutra] |||||| Supports any MCP server for reusable playbook creation. |
3032
| [mcp-agent][mcp-agent] |||| ⚠️ || Supports tools, server connection management, and agent workflows. |
3133
| [MCPHub][MCPHub] | ✅ | ✅ | ✅ | ❌ | ❌ | Supports tools, resources, and prompts in Neovim
3234
| [MCPOmni-Connect][MCPOmni-Connect] |||||| Supports tools with agentic mode, ReAct, and orchestrator capabilities. |
3335
| [Microsoft Copilot Studio] |||||| Supports tools |
36+
| [MindPal][MindPal] |||||| Supports tools for no-code AI agents and multi-agent workflows. |
3437
| [OpenSumi][OpenSumi] |||||| Supports tools in OpenSumi |
3538
| [oterm][oterm] |||||| Supports tools, prompts and sampling for Ollama. |
3639
| [Roo Code][Roo Code] |||||| Supports tools and resources. |
@@ -62,10 +65,12 @@ This page provides an overview of applications that support the Model Context Pr
6265
[GenAIScript]: https://microsoft.github.io/genaiscript/reference/scripts/mcp-tools/
6366
[Goose]: https://block.github.io/goose/docs/goose-architecture/#interoperability-with-extensions
6467
[LibreChat]: https://github.com/danny-avila/LibreChat
68+
[Lutra]: https://lutra.ai
6569
[mcp-agent]: https://github.com/lastmile-ai/mcp-agent
6670
[MCPHub]: https://github.com/ravitemer/mcphub.nvim
6771
[MCPOmni-Connect]: https://github.com/Abiorh001/mcp_omni_connect
6872
[Microsoft Copilot Studio]: https://learn.microsoft.com/en-us/microsoft-copilot-studio/agent-extend-action-mcp
73+
[MindPal]: https://mindpal.io
6974
[OpenSumi]: https://github.com/opensumi/core
7075
[oterm]: https://github.com/ggozad/oterm
7176
[Roo Code]: https://roocode.com
@@ -76,6 +81,7 @@ This page provides an overview of applications that support the Model Context Pr
7681
[TypingMind App]: https://www.typingmind.com
7782
[VS Code]: https://code.visualstudio.com/
7883
[Windsurf]: https://codeium.com/windsurf
84+
[gptme]: https://github.com/gptme/gptme
7985
[Witsy]: https://github.com/nbonamy/witsy
8086
[Zed]: https://zed.dev
8187
[Resources]: https://modelcontextprotocol.io/docs/concepts/resources
@@ -223,6 +229,15 @@ Programmatically assemble prompts for LLMs using [GenAIScript](https://microsoft
223229
- Goose allows you to extend its functionality by [building your own MCP servers](https://block.github.io/goose/docs/tutorials/custom-extensions).
224230
- Includes built-in tools for development, web scraping, automation, memory, and integrations with JetBrains and Google Drive.
225231

232+
### gptme
233+
[gptme](https://github.com/gptme/gptme) is a open-source terminal-based personal AI assistant/agent, designed to assist with programming tasks and general knowledge work.
234+
235+
**Key features:**
236+
- CLI-first design with a focus on simplicity and ease of use
237+
- Rich set of built-in tools for shell commands, Python execution, file operations, and web browsing
238+
- Local-first approach with support for multiple LLM providers
239+
- Open-source, built to be extensible and easy to modify
240+
226241
### Klavis AI Slack/Discord/Web
227242
[Klavis AI](https://www.klavis.ai/) is an Open-Source Infra to Use, Build & Scale MCPs with ease.
228243

@@ -245,6 +260,18 @@ Programmatically assemble prompts for LLMs using [GenAIScript](https://microsoft
245260
- Open-source and self-hostable, with secure multi-user support
246261
- Future roadmap includes expanded MCP feature support
247262

263+
### Lutra
264+
[Lutra](https://lutra.ai) is an AI agent that transforms conversations into actionable, automated workflows.
265+
266+
**Key features:**
267+
- Easy MCP Integration: Connecting Lutra to MCP servers is as simple as providing the server URL; Lutra handles the rest behind the scenes.
268+
- Chat to Take Action: Lutra understands your conversational context and goals, automatically integrating with your existing apps to perform tasks.
269+
- Reusable Playbooks: After completing a task, save the steps as reusable, automated workflows—simplifying repeatable processes and reducing manual effort.
270+
- Shareable Automations: Easily share your saved playbooks with teammates to standardize best practices and accelerate collaborative workflows.
271+
272+
**Learn more:**
273+
- [Lutra AI agent explained](https://www.youtube.com/watch?v=W5ZpN0cMY70)
274+
248275
### mcp-agent
249276
[mcp-agent] is a simple, composable framework to build agents using Model Context Protocol.
250277

@@ -282,6 +309,19 @@ Programmatically assemble prompts for LLMs using [GenAIScript](https://microsoft
282309
- Extend Copilot Studio agents with MCP servers
283310
- Leveraging Microsoft unified, governed, and secure API management solutions
284311

312+
### MindPal
313+
[MindPal](https://mindpal.io) is a no-code platform for building and running AI agents and multi-agent workflows for business processes.
314+
315+
**Key features:**
316+
- Build custom AI agents with no-code
317+
- Connect any SSE MCP server to extend agent tools
318+
- Create multi-agent workflows for complex business processes
319+
- User-friendly for both technical and non-technical professionals
320+
- Ongoing development with continuous improvement of MCP support
321+
322+
**Learn more:**
323+
- [MindPal MCP Documentation](https://docs.mindpal.io/agent/mcp)
324+
285325
### OpenSumi
286326
[OpenSumi](https://github.com/opensumi/core) is a framework helps you quickly build AI Native IDE products.
287327

docs/examples.mdx

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -122,6 +122,7 @@ To use an MCP server with Claude, add it to your configuration:
122122
- [Awesome MCP Servers](https://github.com/punkpeye/awesome-mcp-servers) - Curated list of MCP servers
123123
- [MCP CLI](https://github.com/wong2/mcp-cli) - Command-line inspector for testing MCP servers
124124
- [MCP Get](https://mcp-get.com) - Tool for installing and managing MCP servers
125+
- [Pipedream MCP](https://mcp.pipedream.com) - MCP servers with built-in auth for 3,000+ APIs and 10,000+ tools
125126
- [Supergateway](https://github.com/supercorp-ai/supergateway) - Run MCP stdio servers over SSE
126127
- [Zapier MCP](https://zapier.com/mcp) - MCP Server with over 7,000+ apps and 30,000+ actions
127128

docs/specification/draft/basic/authorization.mdx

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ while maintaining simplicity:
4545
1. MCP authorization servers and MCP clients **SHOULD** support the OAuth 2.0 Dynamic Client Registration
4646
Protocol ([RFC7591](https://datatracker.ietf.org/doc/html/rfc7591)).
4747

48-
1. MCP servers **MUST** implement [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13).
48+
1. MCP servers **MUST** implement OAuth 2.0 Protected Resource Metadata ([RFC9728](https://datatracker.ietf.org/doc/html/rfc9728)).
4949
MCP clients **MUST** use OAuth 2.0 Protected Resource Metadata for authorization server discovery.
5050

5151
1. MCP authorization servers and MCP clients **MUST** implement OAuth 2.0 Authorization
@@ -82,16 +82,20 @@ authorization servers to MCP clients, as well as the discovery process through w
8282
clients can determine authorization server endpoints and supported capabilities.
8383

8484
### 2.3.1 Authorization Server Location
85-
MCP servers **MUST** implement the [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13)
85+
86+
MCP servers **MUST** implement OAuth 2.0 Protected Resource Metadata ([RFC9728](https://datatracker.ietf.org/doc/html/rfc9728))
8687
specification to indicate the locations of authorization servers. The Protected Resource Metadata document returned by the MCP server **MUST** include
8788
the `authorization_servers` field containing at least one authorization server.
8889

8990
The specific use of `authorization_servers` is beyond the scope of this specification; implementers should consult
90-
the [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13) documentation for
91+
OAuth 2.0 Protected Resource Metadata ([RFC9728](https://datatracker.ietf.org/doc/html/rfc9728)) for
9192
guidance on implementation details.
9293

94+
Implementors should note that Protected Resource Metadata documents can define multiple authorization servers. The responsibility for selecting which authorization server to use lies with the MCP client, following the guidelines specified in
95+
[RFC9728 Section 7.6 "Authorization Servers"](https://datatracker.ietf.org/doc/html/rfc9728#name-authorization-servers).
96+
9397
MCP servers **MUST** use the HTTP header `WWW-Authenticate` when returning a _401 Unauthorized_ to indicate the location of the resource server metadata URL
94-
as described in [OAuth 2.0 Protected Resource Metadata](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-resource-metadata-13).
98+
as described in OAuth 2.0 Protected Resource Metadata ([RFC9728](https://datatracker.ietf.org/doc/html/rfc9728)).
9599

96100
MCP clients **MUST** be able to parse `WWW-Authenticate` headers and respond appropriately to `HTTP 401 Unauthorized` responses from the MCP server.
97101

@@ -255,32 +259,31 @@ Servers **MUST** return appropriate HTTP status codes for authorization errors:
255259

256260
## 3. Security Considerations
257261

258-
Implementations **MUST** follow OAuth 2.1 security best practices. Refer to
259-
[RFC9700](https://datatracker.ietf.org/doc/html/rfc9700) for details.
262+
Implementations **MUST** follow OAuth 2.1 security best practices as laid out in [Section 7. Security Considerations](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#name-security-considerations).
260263

261264
### 3.1 Token Theft
262265
Attackers who obtain tokens stored by the client, or tokens cached or logged on the server can access protected resources with
263266
requests that appear legitimate to resource servers.
264267

265-
Clients **MUST** implement secure token storage and follow OAuth 2.0 best practices,
266-
as outlined in [RFC 9700](https://datatracker.ietf.org/doc/html/rfc9700).
268+
Clients **MUST** implement secure token storage and follow OAuth best practices,
269+
as outlined in [OAuth 2.1, section 7.1](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-7.1).
267270

268-
MCP authorization servers SHOULD enforce token expiration and rotation to limit the window of exploitation.
271+
MCP authorization servers SHOULD issue short-lived access tokens token to reduce the impact of leaked tokens. For public clients, MCP authorization servers MUST rotate refresh tokens as described in [Section 4.3.1 of OAuth 2.1](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-4.3.1).
269272

270273
### 3.2 Communication Security
271274
An attacker positioned between MCP clients and MCP servers can intercept tokens via [Man-in-the-Middle (MITM)](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) attacks.
272275

273276
Implementations MUST follow [OAuth 2.1 section 1.5](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-1.5).
274277

275278
Specifically:
276-
1. All authorization endpoints **MUST** be served over HTTPS.
279+
1. All authorization server endpoints **MUST** be served over HTTPS.
277280
1. All redirect URIs **MUST** be either `localhost` or use HTTPS.
278281

279282
### 3.3 Authorization Code Protection
280283

281-
An attacker who has gained access to an authorization code contained in an authorization response can try to redeem the authorization code for an access token or otherwise make use of the authorization code. (Further described in [RFC 9700 Section 4.5](https://www.rfc-editor.org/rfc/rfc9700.html#name-authorization-code-injectio))
284+
An attacker who has gained access to an authorization code contained in an authorization response can try to redeem the authorization code for an access token or otherwise make use of the authorization code. (Further described in [OAuth 2.1, section 7.5](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-7.5))
282285

283-
MCP clients **MUST** implement PKCE according to [OAuth 2.1 section 7.5.2](https://www.ietf.org/archive/id/draft-ietf-oauth-v2-1-12.html#name-countermeasures). PKCE helps prevent authorization code interception attacks by requiring clients to create a secret verifier-challenge pair, ensuring that only the original requestor can exchange an authorization code for tokens.
286+
MCP clients **MUST** implement PKCE according to [OAuth 2.1 section 7.5.2](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-7.5.2). PKCE helps prevent authorization code interception and injection attacks by requiring clients to create a secret verifier-challenge pair, ensuring that only the original requestor can exchange an authorization code for tokens.
284287

285288

286289
### 3.3 Open Redirection
@@ -293,12 +296,18 @@ Authorization servers **MUST** validate exact redirect URIs against pre-register
293296
MCP clients **SHOULD** use and verify state parameters in the authorization code flow
294297
and discard any results that do not include or have a mis-match with the original state.
295298

296-
Authorization servers **MUST** take precautions to prevent redirecting user agents to untrusted URI's, following suggestions laid out in [RFC 9700 Section 4.11.2](https://www.rfc-editor.org/rfc/rfc9700.html#section-4.11.2)
299+
Authorization servers **MUST** take precautions to prevent redirecting user agents to untrusted URI's, following suggestions laid out in [OAuth 2.1, Section 7.12.2](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#section-7.12.2)
297300

298301
Authorization servers **SHOULD** only automatically redirect the user agent if it trusts the redirection URI. If the URI is not trusted, the authorization server MAY inform the user and rely on the user to make the correct decision.
299302

303+
### 3.4 Confused Deputy Problem
304+
305+
Attackers can exploit MCP servers acting as intermediaries to third-party APIs, leading to confused deputy vulnerabilities. By using stolen authorization codes, they can obtain access tokens without user consent. See [Security Best Practices 2.1](/specification/draft/basic/security_best_practices) for details.
300306

301-
### 3.4 Access Token Privilege Restriction
307+
MCP proxy servers using static client IDs **MUST** obtain user consent for each dynamically
308+
registered client before forwarding to third-party authorization servers (which may require additional consent).
309+
310+
### 3.5 Access Token Privilege Restriction
302311

303312
An attacker can gain unauthorized access or otherwise compromise a MCP server if the server accepts tokens issued for other resources.
304313

@@ -322,4 +331,6 @@ For example, a MCP server could validate inbound tokens through one of the follo
322331
MCP servers **MUST** strictly validate token audiences and only accept tokens specifically intended for themselves. Implementers **MUST NOT** design architectures where clients send
323332
tokens through the MCP server intended for other resources.
324333

325-
If the MCP server makes requests to upstream APIs, it acts as an OAuth client to the upstream API. The access token it uses at the upstream API may be an opaque token, so the MCP server has no way to introspect the token to validate the audience or know what user it is associated with. Even if the token were a JWT [RFC 9068](https://www.rfc-editor.org/rfc/rfc9068.html) token, the audience of that token would not be the MCP server, so the MCP server is not intended to parse the token anyway. The MCP server **MUST NOT** accept such tokens to grant access to its resources.
334+
If the MCP server makes requests to upstream APIs, it acts as an OAuth client to the upstream API. The access token it uses at the upstream API may be an opaque token, so the MCP server has no way to introspect the token to validate the audience or know what user it is associated with. Even if the token were a JWT [RFC 9068](https://www.rfc-editor.org/rfc/rfc9068.html) token, the audience of that token would not be the MCP server, so the MCP server is not intended to parse the token anyway. The MCP server **MUST NOT** accept such tokens to grant access to its resources.
335+
336+

0 commit comments

Comments
 (0)