Verified65% confidenceFactExact time
In MCP's security design, tool invocations are stipulated to require explicit user authorization, and resource access is constrained by permission boundaries.
3
Sources
65%
Confidence
Long-term
Relevance
7/21/2026
First Seen
Sources
Related Claims
UnverifiedA mature MCP gateway needs a built-in user consent flow capable of triggering confirmation before an Agent performs high-risk actions, recording user authorization status, and updating permissions when authorization changes79% similarVerifiedMCP's permission model draws on the OAuth 2.0 authorization code flow, requiring explicit user authorization for tool invocation.77% similarUnverifiedIn MCP architecture, authorization decisions should not remain solely at the authentication layer but need to be pushed down to the actual execution stage of tool calls.77% similarUnverifiedMCP only addresses the standardization of connectivity and invocation, and is not responsible for security; responsibilities such as authentication and authorization, approval of dangerous operations, and verification of service trustworthiness must be handled by the application layer.76% similarUnverifiedMCP协议在工具调用安全性方面采用了人机协同（Human-in-the-Loop）的设计理念76% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/581103API
curl https://kongchang.com/api/v1/knowledge/claims/581103MCP
get_claim(id=581103)