Repository navigation
MCP Python SDK Implementation Gap-13: Server Missing Token Issuer Validation #1445
Description
Initial Checks
- I confirm that I'm using the latest version of MCP Python SDK
- I confirm that I searched for my issue in https://github.com/modelcontextprotocol/python-sdk/issues before opening this issue
Description
Summary
The MCP Python SDK server violates the specification requirement that "MCP servers MUST validate that tokens presented to them were specifically issued for their use." The server's verify_token() implementation only performs token loading without validating the token's issuer, allowing tokens from other authorization servers to be accepted.
Issue Details
Rule Violation
MCP Specification: "MCP servers MUST validate that tokens presented to them were specifically issued for their use."
Root Cause
File: src/mcp/server/auth/provider.py
# Lines 304-306: ProviderTokenVerifier.verify_token()
async def verify_token(self, token: str) -> AccessToken | None:
"""Verify token using the provider's load_access_token method."""
return await self.provider.load_access_token(token)Current validation only checks:
- ✅ Token exists in storage
- ✅ Token is not expired (in
BearerAuthBackend)
Missing critical validation:
- ❌ Token issuer verification
Evidence of Missing Issuer Validation
File: src/mcp/server/auth/middleware/bearer_auth.py
# Lines 30-49: BearerAuthBackend.authenticate()
async def authenticate(self, conn: HTTPConnection):
# ... extract token ...
# Validate the token with the verifier
auth_info = await self.token_verifier.verify_token(token)
if not auth_info:
return None
if auth_info.expires_at and auth_info.expires_at < int(time.time()):
return None
return AuthCredentials(auth_info.scopes), AuthenticatedUser(auth_info)
# ❌ Missing: No validation of token issuer against server's issuerImpact
- Compliance Violation: Fails "MUST validate tokens were specifically issued for their use" requirement
Files Affected
src/mcp/server/auth/provider.py(lines 304-306)src/mcp/server/auth/middleware/bearer_auth.py(lines 30-49)
One Possible Solution
Add issuer validation to verify_token() or BearerAuthBackend.authenticate():
# Validate token issuer matches server's issuer
if auth_info.issuer and auth_info.issuer != self.server_issuer_url:
return None # Token not issued for this serverRelated Issues
This issue is related to #1435 (RFC 8707 resource validation), both stemming from incomplete verify_token() implementation. While they address different compliance requirements, fixing the comprehensive token validation in verify_token() would resolve both issues.
Example Code
Python & MCP Python SDK
latest
Activity
felixweinberger commentedon Oct 8, 2025
Hi @younaman thanks for all these submissions so far - could you confirm whether you've validated and discovered these gaps directly via inspection or are these generated via an LLM or coding agent analysis?
That would help us evaluate the priority here - in general if these are gaps you were able to confirm yourself that would provide a higher priority here.
felixweinberger commentedon Oct 10, 2025
Hi @younaman thanks for reporting all these issues - I think a lot of this goes very much in line with a SEP we currently have open for Conformance testing, please take a look modelcontextprotocol/modelcontextprotocol#1627 by @pcarleton with an early prototype currently WIP modelcontextprotocol/modelcontextprotocol#948 by @ochafik
TL;DR we're working on building a test suite that makes it possible to verify correct, spec compliant behavior via automated test suites, with an initial focus on auth (which is also the area of most of the issues you reported here).
It would be great if you'd be able to contribute to that implementation with runnable tests that demonstrate the compliance failure - that way we not only record potential spec violations but also have them as runnable regression tests to contribute to spec stability over time across all our SDKs (not just Python).
Please take a look at the links for more info - I believe it'll be most useful to contribute these as test cases to modelcontextprotocol/modelcontextprotocol#1627
younaman commentedon Oct 10, 2025
@felixweinberger Hi, thanks for sharing this!
I’d be very happy to contribute to the conformance testing efforts. I’m currently busy with my paper writing and plan to submit it in mid-November. After that, I’ll take a closer look at the SEP and the prototype.
I’d also be glad to help with compliance testing for other SDKs. In fact, I’ve already found similar compliance issues in several other SDKs. I’ll submit issues for those as well, and they can serve as inputs for regression testing and help strengthen MCP’s conformance checks.
If you have any questions or concerns, feel free to let me know.
younaman commentedon Oct 11, 2025
I wrote a static analysis tool to identify all these potential risks. After that, I check each result manually to confirm it's a true positive. After that, I generate this report with the help of cursor.
younaman commentedon Oct 11, 2025
Sorry for responding it late, my mailbox only shows your latest comments and ignores the former ones :)
felixweinberger commentedon Oct 13, 2025
Very cool - I think sharing what you can on how you implemented that could be a great addition to modelcontextprotocol/modelcontextprotocol#1627
younaman commentedon Oct 13, 2025
@felixweinberger Thanks! I plan to open source it and will share you the link once it’s published.