Topic
How the Model Context Protocol specifies OAuth-based authorization for remote MCP servers, including audience-bound access tokens.
Developer clients reach a key-protected Azure Functions MCP server by attaching a header; the Claude desktop app has no such field, and the one-click fix still left VS Code holding an invalid_target error from Entra.
Reality
Mandatum signs each delegation link to its parent by hash and leaves the decision to an AuthZEN policy engine. The sequence check that blocks a write after an external read needs a single in-process enforcement point.
Reality
The ext-auth repo holds two files: a stable extension that authenticates a person through an IdP redirect, and a draft machine flow that hands the agent a pre-registered key it has to keep. Both agent-identity proposals are open.
Reality
The S256 pin is a per-client attribute, and the executor that builds a client from a published metadata document sets three attributes, all unrelated to PKCE. The executor addition imports cleanly, yet it never runs.
Reality
A dev.to writeup documents Amazon Cognito killing a spec-compliant MCP connector at the first redirect, and the only fix on offer is a proxy that strips one parameter and nothing else.
Reality