How-to·February 17, 2026, 01:03

How AI tools should securely log in to MCP servers

AI-generated from the sources listed, with automated source checks.

The MCP standard, which lets AI programs use external tools, includes rules for secure access over the web. The rules are optional, but developers are encouraged to follow them, and OWASP has published a guide.

MCP (Model Context Protocol) is a technical standard that lets AI programs connect to external tools and data through an MCP server. When an AI program needs to use such a server, it is important that only the right parties get access. That is where authorization comes in: it is the part that determines who is allowed to do what.

Authorization is optional in MCP. But if it is supported, implementations that run over HTTP (ordinary web traffic) should follow the official specification from June 18, 2025. Solutions that run locally via STDIO should instead retrieve credentials from the environment they run in.

Built on OAuth

The specification is based on OAuth 2.1, a well-known method for giving an app access without handing over a password. Here, the MCP server is the protected resource, while the AI program is the client. A separate authorization server issues access tokens, which are essentially digital tickets.

Some of the requirements in the specification:

- Tokens must be sent in a specific header in every request and must not appear in the URL itself. - The server must verify that a token was issued specifically for it and reject others. Invalid or expired tokens must return a 401 error. - The server must not pass the token it receives on to other services. Those require their own tokens. - Clients must use PKCE, which protects against others intercepting or injecting codes during login. - All endpoints on the authorization server must run over HTTPS. - Access tokens should have a short lifetime and must be stored securely.

The specification also requires proxy servers to obtain the user's consent before forwarding requests to third parties. This is meant to prevent so-called confused deputy attacks, in which an intermediary is tricked into misusing its privileges.

Guide from OWASP

On February 16, 2026, the OWASP Gen AI Security Project published a guide to secure development of MCP servers. It covers secure architecture, input validation, session isolation and hardened operations, among other topics, and it is aimed at software architects, platform engineers and development teams.

According to the guide, MCP servers differ from traditional APIs in that they work with delegated user permissions and dynamic, tool-based architectures. As a result, vulnerabilities can have a greater impact when tool calls are chained together.

For ordinary users, this means that AI tools with access to your data should be built on these basic rules. The information here consists of general security requirements and is not a step-by-step guide.