Flow · agent-as-client
Agent host as OAuth client (MCP HTTP)
The MCP client discovers how to authorize from Protected Resource Metadata and performs OAuth 2.1. The model never sees a protocol other than 'call this tool'.
Actors
User · MCP client (agent host) · MCP server · Authorization server
Sequence
- 1
MCP client→MCP server
Unauthenticated HTTP request
- 2
MCP server→MCP client
401 + WWW-Authenticate resource_metadata URL (RFC 9728)
- 3
MCP client→Authorization server
Discover AS (RFC 8414 / OIDC), CIMD or DCR, Authorization Code + PKCE, resource=MCP URI
- 4
MCP client→MCP server
Authorization: Bearer. Server checks audience == itself
Caveats
Stdio MCP MUST NOT use this profile. Tokens must not be forwarded to other servers. CIMD is preferred; DCR is deprecated in the 2026-07-28 spec. The spec cites OAuth 2.1 draft-13 and CIMD draft-00; implement current revisions for token handling.
Why this hop looks this way
The model never sees OAuth. The host is the client. Audience validation at the MCP server is the difference between a calendar token and a payments incident.