Security

Authenticating MCP servers

Almost every MCP tutorial, mine included, ships a server with no idea who's calling it: any client that reaches the endpoint gets the same data. For a while the protocol had no answer to that. It does now, and auth is the part of the MCP spec that has moved most. Here's the smallest server that sits on the right side of it, with a bearer token at the door and each user seeing only their own data, checked on the wire.