build1 publisher
MCP servers need their RFC 9728 resource URL to reject tokens minted for other servers
MCP servers that skip audience binding accept tokens minted for other servers, says a dev.to OAuth 2.1 guide that puts it in the 80% most guides skip. The check depends on RFC 9728 metadata the server publishes and a resource parameter the client sends.
Publishers:dev.to
Reality
- Evidence30
- Adoption
- Insufficient
- Hype gap+25
- Incentives60
- Confidence35