Unverified50% confidenceSolutionExact time
The correct approach is for the MCP server to re-apply for a new dedicated token under its own identity when calling downstream services, rather than forwarding the incoming token.
1
Sources
50%
Confidence
Long-term
Relevance
10/10/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedAn MCP server may only accept tokens issued for itself and must not forward client tokens to another API, as doing so would create a Confused Deputy vulnerability.77% similarUnverifiedAt the authorization layer, an MCP server can act as an intermediary proxy responsible for holding, managing, and rotating access credentials, so that the Agent itself does not need to directly handle the underlying keys76% similarUnverifiedIn MCP, tokens obtained by a client are scoped to a single server and carry a single, narrow permission.76% similarUnverifiedUnder the ID-JAG model, MCP servers need to transition from passive resource endpoints that accept access tokens to active, verification-capable participants in the enterprise authorization system.74% similarUnverifiedThe MCP authorization specification emphasizes token audience validation, requiring MCP servers to verify that a token was indeed issued to themselves in order to prevent confused deputy attacks.73% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/994266API
curl https://kongchang.com/api/v1/knowledge/claims/994266MCP
get_claim(id=994266)