MCP host ↔ MCP server (tools)

A model host (Claude Desktop, an IDE, a custom runtime) calls tools on an HTTP MCP server. The host is the OAuth client. The MCP authorization spec is an OAuth 2.1 profile, not a new token type.

When you see it

Claude Desktop attached to a remote MCP server, Cursor or another IDE with MCP tools, any custom host that speaks MCP HTTP. Stdio MCP is a local pipe and MUST NOT use this OAuth profile — if your 'MCP server' is a subprocess, you are not on this row.

Actors and trust

UserUser
Sits at the host. Authorizes the host to call this MCP server as them.
MCP host (client)Agent instance
The OAuth client. Identified by CIMD URL or (deprecated) DCR. The model never sees OAuth.
MCP server (resource)Resource
The RS. Publishes RFC 9728 metadata, validates audience == itself, does not forward tokens.
Authorization serverOther
Discovered from PRM. Issues tokens audience-restricted to the MCP server URI.

Topology

UserMCP hostAuthorization serverMCP server (tools)

MCP host→ Unauthenticated MCP HTTP request →MCP server (tools)
MCP server (tools)→ 401 + WWW-Authenticate resource_metadata (RFC 9728) →MCP host
MCP host→ CIMD or DCR, auth code + PKCE, resource = MCP URI →Authorization server
User→ Consent at the host's browser →Authorization server
MCP host→ Authorization: Bearer; server checks aud == itself →MCP server (tools)

Host is the OAuth client. MCP server is the resource. The model only sees 'call this tool'.

Primary

MCP authorization
OAuth 2.1
PKCE
Protected Resource Metadata
RFC 9728.
Client ID Metadata Documents
Preferred client identification in the 2026-07-28 MCP spec.

Optional

Resource Indicators
Dynamic Client Registration
Deprecated in MCP 2026-07-28 in favor of CIMD.
DPoP
AIMS (agent auth BCP)draft / churn
Individual draft — expect churn.

Do not use

AAuthdraft / churn
Only if you deliberately replace MCP-OAuth with agent-native signatures. Default MCP hosts will not.
OAuth on stdio MCP
The MCP spec: stdio MUST NOT use the HTTP authorization profile.
Forwarding the host token to another server
Confused deputy. The MCP server is the audience, not a gateway.

Why these, and not those

MCP HTTP authorization is explicitly an OAuth 2.1 profile: Protected Resource Metadata to find the AS, CIMD preferred over Dynamic Client Registration, authorization code + PKCE, resource indicator = the MCP server. That is why this row is not 'invent a tool token.' AAuth applies only if you deliberately leave the MCP-OAuth profile and speak agent-native HTTP signatures instead — a different contract than the MCP spec, and one MCP hosts will not implement by default. Do not put OAuth on stdio MCP. Do not let the server forward the host's token to someone else.

Related flows

Sequence diagrams, not this topology cut. All flows