Somebody at Sentry filed a bug last month: Cursor Automations started hitting rate-limit errors almost immediately after authenticating. The bucket was sized for humans — 60 requests per 60 seconds — and an agent tore through it in seconds.
That's the MCP auth problem in miniature. You've got a server exposing tools. Agents call those tools. You want to slow down abuse, charge per call, or just make sure you don't blow up your LLM budget on some runaway loop. How do you do that without wiring up a full OAuth stack that breaks the first time an agent doesn't have a browser to open?
Three real options exist right now. Here's how they compare.
The MCP spec mandates OAuth 2.1 for authorization. If you're building a production server for enterprise customers — actual humans with accounts — this is the right call. You get scoped access, token revocation, audit trails. SSO works. Compliance teams stop emailing you.
The problem is agents. OAuth 2.1 has an authorization code flow that requires a redirect URI. An agent running headless doesn't have a browser. DPoP and Workload Identity Federation are on the MCP roadmap but not shipped yet. If you need auth today and your callers are mostly agents, OAuth puts you in a hole.
Good fit: enterprise SaaS, human-driven clients, compliance-heavy contexts.
Bad fit: anonymous agents, public APIs, pay-per-call services.
L402 is an HTTP extension where a server responds to an unauthorized request with 402 Payment Required
and an invoice in the WWW-Authenticate
header. The client pays it over Lightning and retries with the preimage as a credential.
Two npm packages ship L402 for MCP right now: lightning-wallet-mcp
and l402-kit-mcp
. The model is clean: each tool call costs a fixed number of sats. No accounts, no sessions, no user. An agent with a Lightning wallet (Alby, Phoenixd, NWC) can handle the whole flow programmatically.
curl -X POST https://your-mcp-server/tools/call \
-H "Content-Type: application/json" \
-d '{"name": "expensive_tool", "arguments": {}}'
curl -X POST https://your-mcp-server/tools/call \
-H "Authorization: L402 <macaroon>:<preimage>" \
-H "Content-Type: application/json" \
-d '{"name": "expensive_tool", "arguments": {}}'
Good fit: agents with Lightning wallets, micropayment-per-call APIs, Bitcoin-native monetization.
Bad fit: agents without wallets, free tiers, contexts where payment friction kills adoption.
PoW is the weird one. Instead of paying money, the caller burns CPU to solve a hashcash-style puzzle. The server sets a difficulty. The caller grinds until they find a nonce. No wallet required.
curl https://your-mcp-server/api/challenge
npx @powforge/captcha solve --challenge abc123 --difficulty 4
curl -X POST https://your-mcp-server/tools/call \
-H "X-PoW-Solution: challenge=abc123,nonce=7f3a..." \
-H "Content-Type: application/json" \
-d '{"name": "tool", "arguments": {}}'
The cost scales with difficulty. A legitimate caller solving once is fine. An abuser trying to hammer 10,000 calls hits a wall because each requires fresh compute. No central authority. No wallet. No redirect.
@powforge/captcha-mcp
ships this as middleware for existing MCP servers. Wrap your server, set a difficulty, and callers solve before tool calls go through. It also supports L402 as an escape valve: pay sats instead of grinding if you'd rather not burn CPU.
Good fit: anonymous agents, public APIs, abuse prevention without monetization, PoW-or-pay dual rail.
Bad fit: high-throughput legitimate callers (CPU cost adds latency), real-time tools where every millisecond counts.
| OAuth 2.1 | L402 Lightning | Proof-of-Work | |
|---|---|---|---|
| Requires user account | Yes | No | No |
| Requires Lightning wallet | No | Yes | No |
| Works headless today | Partial | Yes | Yes |
| Revenue per call | No | Yes (sats) | No |
| Stateless | No | Yes | Yes |
An Astrix Security study this year found 88% of MCP servers require credentials of some kind but document almost none of it. The OpenClaw scan found 42,000+ unauthenticated MCP instances publicly exposed in January 2026. Most of those aren't enterprise installs — they're side projects and weekend builds.
For that crowd, OAuth is overkill. L402 is elegant if the caller has a wallet. PoW gives you friction without a wallet requirement — callers can always get through, they just can't do it for free at scale.
The Sentry rate-limit bug is fixable with any of these. But if you're building for agents first, OAuth is the last thing you reach for — not the first.
@powforge/captcha-mcp
(PoW + L402 middleware): @powforge/captcha
(standalone solver):