Three ways to gate an MCP server: OAuth, L402, and proof-of-work Sentry engineers encountered a rate-limiting bug when Cursor Automations exhausted a human-sized bucket of 60 requests per 60 seconds in seconds, highlighting the challenge of gating MCP servers for agent traffic. Three real-world authorization methods exist today: OAuth 2.1 for enterprise human-driven clients, L402 for Lightning-based micropayments per tool call, and proof-of-work for anonymous abuse prevention without wallets or accounts. The `@powforge/captcha-mcp` middleware also supports a dual-rail approach, letting callers pay sats via L402 instead of burning CPU. Somebody at Sentry filed a bug last month: Cursor Automations started hitting rate-limit errors almost immediately after authenticating. The bucket was sized for humans — 60 requests per 60 seconds — and an agent tore through it in seconds. That's the MCP auth problem in miniature. You've got a server exposing tools. Agents call those tools. You want to slow down abuse, charge per call, or just make sure you don't blow up your LLM budget on some runaway loop. How do you do that without wiring up a full OAuth stack that breaks the first time an agent doesn't have a browser to open? Three real options exist right now. Here's how they compare. The MCP spec mandates OAuth 2.1 for authorization. If you're building a production server for enterprise customers — actual humans with accounts — this is the right call. You get scoped access, token revocation, audit trails. SSO works. Compliance teams stop emailing you. The problem is agents. OAuth 2.1 has an authorization code flow that requires a redirect URI. An agent running headless doesn't have a browser. DPoP and Workload Identity Federation are on the MCP roadmap but not shipped yet. If you need auth today and your callers are mostly agents, OAuth puts you in a hole. Good fit: enterprise SaaS, human-driven clients, compliance-heavy contexts. Bad fit: anonymous agents, public APIs, pay-per-call services. L402 is an HTTP extension where a server responds to an unauthorized request with 402 Payment Required and an invoice in the WWW-Authenticate header. The client pays it over Lightning and retries with the preimage as a credential. Two npm packages ship L402 for MCP right now: lightning-wallet-mcp and l402-kit-mcp . The model is clean: each tool call costs a fixed number of sats. No accounts, no sessions, no user. An agent with a Lightning wallet Alby, Phoenixd, NWC can handle the whole flow programmatically. First call — server responds with 402 curl -X POST https://your-mcp-server/tools/call \ -H "Content-Type: application/json" \ -d '{"name": "expensive tool", "arguments": {}}' HTTP/1.1 402 Payment Required WWW-Authenticate: L402 invoice="lnbc...", macaroon="..." Pay the invoice over Lightning, get the preimage Retry with credentials curl -X POST https://your-mcp-server/tools/call \ -H "Authorization: L402