{"slug": "oauth-on-mcp-is-not-the-same-as-authorizing-each-tool-call", "title": "OAuth on MCP is not the same as authorizing each tool call", "summary": "A developer argues that OAuth on the Model Context Protocol (MCP) only establishes caller identity and does not by itself authorize individual tool calls, a gap that matters as the 2026-07-28 MCP spec adds issuer validation, the CIMD direction, and Mcp-Method/Mcp-Name headers. The write-up recommends tiering requests by risk — treating read_ticket differently from issue_refund or drop_table — and using an MCP client → gateway → PDP → MCP server pattern with deny-by-default and step-up checks for high-risk operations.", "body_md": "OAuth on MCP answers “who is calling?” It does not, by itself, answer whether a particular `tools/call` should run.\n\nThe 2026-07-28 MCP spec tightens auth and routing with issuer validation, the CIMD direction, and `Mcp-Method` / `Mcp-Name` headers. Those are useful signals, but authentication is still only one decision: AuthN verifies who is calling; tool-call authorization asks whether this principal may run this tool, on this resource, in this context, right now.\n\nThat context matters for risk. A `read_ticket` should not necessarily get the same friction as `issue_refund`, and neither should be treated like `drop_table`. Use the method/name headers to help tier the request.\n\nA practical pattern is `MCP client → gateway → PDP → MCP server`, with deny-by-default and step-up checks for high-risk operations.\n\nWe wrote about the distinction and the practical design in [our write-up](https://www.permit.io/blog/mcp-auth-vs-tool-call-authorization-2026-07-28).", "url": "https://wpnews.pro/news/oauth-on-mcp-is-not-the-same-as-authorizing-each-tool-call", "canonical_source": "https://dev.to/authbyexample1/oauth-on-mcp-is-not-the-same-as-authorizing-each-tool-call-1j09", "published_at": "2026-09-24 13:40:21+00:00", "updated_at": "2026-09-24 13:58:45.843902+00:00", "lang": "en", "topics": ["ai-agents", "agent-protocols", "ai-safety", "developer-tools"], "entities": ["Model Context Protocol", "Permit.io"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/oauth-on-mcp-is-not-the-same-as-authorizing-each-tool-call", "markdown": "https://wpnews.pro/news/oauth-on-mcp-is-not-the-same-as-authorizing-each-tool-call.md", "text": "https://wpnews.pro/news/oauth-on-mcp-is-not-the-same-as-authorizing-each-tool-call.txt", "jsonld": "https://wpnews.pro/news/oauth-on-mcp-is-not-the-same-as-authorizing-each-tool-call.jsonld"}}