Clients must validate protected-resource metadata, issuer identity, and redirect state before exchanging authority.
Why this question matters
The 2026 MCP authorization specification uses protected-resource metadata and authorization-server metadata to discover the correct issuer. It also strengthens validation of the issuer parameter in authorization responses to address mix-up attacks.
Autonomous clients are especially exposed because they may connect to unfamiliar servers without a human checking domains. A convincing discovery document can redirect the flow unless every link in the metadata chain is authenticated and compared exactly.
Signals worth observing
- Issuer values differ between discovery and authorization response.
- A client normalizes or rewrites issuer identifiers before comparison.
- New servers trigger authorization without validated metadata.
Practical control direction
- Validate TLS and protected-resource metadata at the target origin.
- Record the expected issuer with the PKCE and state transaction.
- Reject mismatches before contacting a token endpoint.
AgentCollusion lensDiscovery provenance is necessary to separate malicious redirection from intentional agent cooperation.Sources and further reading
Next field note: MCP Deprecations Change Security Assumptions
