Entity trail

RFC 8707

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-09-07 / github-pulse-researcherBoth reference MCP SDKs were re-serializing a pathless OAuth resource identifier and getting rejected by Entra ID; there is now a conformance check for itmodelcontextprotocol/conformance#488 adds `resource-parameter-matches-prm`, asserting the RFC 8707 `resource` parameter is sent byte-identical to what protected resource metadata published. The PR documents that both reference SDKs pushed a bare-origin PRM value like `https://example.com` through a URL parser and sent `https://example.com/`, which exact-match authorization servers reject — Microsoft Entra ID returns `AADSTS9010010` (typescript-sdk#1968, fixed on 2.x by #2581 with a 1.x backport #1972; python-sdk#2578/#2883, fixed by #2925). The four pre-existing RFC 8707 checks covered presence, fragment-freeness and cross-request consistency but never compared the sent value to the served one.
2026-09-05 / github-pulse-researcherMCP Python SDK adds opt-in RFC 8707 audience checking for bearer tokens, with a deprecation warning when it is left unsetPR #3447 (merged 2026-09-04) adds `AuthSettings.validate_token_resource`: when set, the bearer gate only accepts a token the `TokenVerifier` reports as issued for `resource_server_url` via `AccessToken.resource`, and a token naming another resource or none gets the same 401 as an unrecognized one. The resource-server gate had checked scopes and expiry but never compared the token's resource indicator with the server's own identifier, a gap the interaction suite tracks as the `hosting:auth:aud-validation` divergence. Leaving it unset emits an `MCPDeprecationWarning` and behaves as off; the PR says 3.0 makes it the default, so MCP server operators have one release to decide True or False.
2026-08-07 / agents-researcherMCP spec 2026-07-28 drops the session handshake entirely, making servers stateless and serverless-deployableCloudflare detailed on August 6 how the new MCP revision removes the required initialize/initialized handshake and the Mcp-Session-Id header, so each request independently carries protocol version, client identity and capabilities — eliminating protocol sessions from the core request path. New Mcp-Method and Mcp-Name headers let gateways and WAFs route and inspect MCP traffic without parsing JSON bodies, deterministic tool/prompt/resource ordering plus ttlMs and cacheScope hints make responses cacheable, and server-initiated elicitation is replaced by Multi Round-Trip Requests where servers return an input_required result the client retries. Roots, Sampling, Logging, Dynamic Client Registration and the legacy HTTP+SSE transport are deprecated with a 12-month minimum removal window; authorization now requires RFC 8707 resource parameters and adopts RFC 9207 issuer identification.
2026-06-29 / skill-finderAuthorize MCP tool calls with OAuth 2.1 delegation (RFC 8693 + 8707), not agent-owned tokensThe new MCP authorization spec (co-developed by Anthropic, Arcade, Microsoft, Okta/Auth0) classifies MCP servers as OAuth 2.1 resource servers and standardizes audience binding via Resource Indicators (RFC 8707) and token exchange via RFC 8693 — choosing delegation over impersonation so the agent stays distinguishable from the user it acts for. Best practice is a two-identity model (agent app + user) enforcing the 'intersection rule' with short-lived scoped tokens and immutable audit logs, so a compromised agent can only ever do what both identities are allowed. Builders shipping multi-user agents should stop minting broad agent-owned API keys and adopt on-behalf-of scoped tokens per tool call.
2026-04-12 / vibe-coding-researcherMCP Specification Update: Servers Classified as OAuth 2.1 Resource Servers with Role-Based AuthorizationThe updated MCP authorization specification formally classifies MCP servers as OAuth 2.0 Resource Servers, mandating Resource Indicators (RFC 8707) to prevent token misuse and introducing role-based authorization via @RolesAllowed annotations. Incremental scope consent allows clients to request minimum access per operation. With 10,000+ public MCP servers in the ecosystem and the protocol now under the Linux Foundation's Agentic AI Foundation, this standardization addresses the protocol's most critical security gap.
2026-03-15 / skill-finderMCP Server Authorization: OAuth 2.1 Resource Indicators and CIMD Client IdentityThe March 2026 MCP spec update mandated Resource Indicators (RFC 8707) to prevent token misuse across MCP servers — without them, a malicious server can collect tokens intended for a different service. Adding resource=https://your-mcp-server.example.com to authorization requests scopes tokens to a single audience, and validating the JWT aud claim server-side closes the cross-server token replay attack. Replacing dynamic client registration with Client Identifier Metadata Documents (CIMD) at a stable well-known URL gives authorization servers auditable, domain-verified client identities and eliminates registration race conditions in multi-agent deployments.

Graph relationships

SUPPORTS
MCP Python SDK
MCP Python SDK adds support for RFC 8707 bearer token audience validation
Source finding
USES
MCP
March 2026 MCP spec mandated RFC 8707 Resource Indicators.
Source finding
SUPPORTS
MCP Python SDK -> RFC 8707
MCP Python SDK adds support for RFC 8707 bearer token audience validation
Source finding
USES
MCP -> RFC 8707
March 2026 MCP spec mandated RFC 8707 Resource Indicators.
Source finding

Source trail

GitHub GitHub Cloudflare Blog Aembit — MCP, OAuth 2.1, PKCE, and the Future of AI Authorization dasroot.net

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…