MCP Authorization Extensions (ext-auth)
Official repo of optional, additive extensions to MCP authorization, such as Enterprise-Managed Authorization (stable) and OAuth Client Credentials (draft).
Tags
Description
Follows MCP governance (SEPs) with dedicated authorization-extension maintainers. Extensions are optional, composable and versioned independently of the core spec.
Related
- MCP Authorization (OAuth 2.1 for MCP): The MCP specification's transport-level authorization flow for HTTP-based MCP servers, based on a subset of OAuth 2.1 and related RFCs.
- Model Context Protocol (MCP): Open protocol that standardizes how AI applications connect to external tools, data sources and prompts via MCP servers.
- Cross App Access (ID-JAG): IETF OAuth draft (Identity Assertion JWT Authorization Grant) letting an app use an SSO identity assertion, via the trusted IdP, to get access tokens for a third-party API.
Guides & comparisons
- Add OAuth authorization to your own MCP server (Guide): A server-side walkthrough of the MCP 2026-07-28 authorization spec: publish RFC 9728 protected resource metadata, answer 401 and 403 challenges, verify JWT audience per RFC 8707, enforce per-tool scopes, and never pass tokens through. Tested with the MCP TypeScript SDK v2.
Sources
Machine-readable
- JSON
- Markdown
- Source file on GitHub (edit via pull request)