Authorization: OAuth 2.1 for HTTP MCP Servers

Over stdio the connection is trusted: the server is a local subprocess the client launched. Over Streamable HTTP it is not, and a remote server has to prove who is calling before it answers. MCP&rsquo;s answer is OAuth 2.1, with the server cast as a resource server. Authorization is optional in the protocol, but when a server uses it, this is the shape. This post protects a real server, reads the…