MCP SDK Starter Guides Leave Authorization Outside the HTTP Setup Path

MCP’s four sampled Tier-1 Streamable HTTP starter paths all show builders how to expose a working endpoint, but none enables authentication or scoped authorization in the example being copied. The result is not an absence of security capability: the SDK ecosystem includes local-exposure safeguards and opt-in access controls. The gap is the handoff between the two.

That handoff matters because Streamable HTTP is the MCP transport used to make a server reachable by URL. Introduced in protocol version 2025-03-26 to replace the older HTTP-plus-SSE transport, it uses one HTTP endpoint that accepts POST requests and can return either a JSON response or a request-scoped server-sent-events stream.

The shortest route to a server stops before identity

The finding comes from the first documented Streamable HTTP server flow in four Tier-1 SDK paths. It is not a survey of deployed MCP services or every security page in the SDK documentation. It does establish a narrower practical result: the code and commands most likely to be copied for a first HTTP server do not determine who the caller is or which tools that caller may use.

Python makes the pattern especially clear. Its quick start serves a server over Streamable HTTP, connects a client to localhost:8000, and calls a tool without credentials. That is a compact demonstration of the server and client APIs, not an access-control recipe.

Local defaults reduce exposure, not permissions

The protocol does set a security baseline. Servers must validate Origin headers and return HTTP 403 for an invalid Origin. For local deployments, it recommends binding only to localhost, and it recommends proper authentication for connections. But the transport does not prescribe a concrete authentication scheme.

Those measures solve different problems. Origin checks and local-only binding help limit unintended interaction with a local service, including DNS-rebinding attacks. Authentication is a separate decision about whether a connection represents a caller the service should accept.

Python’s ASGI deployment guidance shows how much protection a local default can provide. Its Streamable HTTP application answers only requests addressed to localhost out of the box. A server behind a real hostname rejects requests with HTTP 421 until its operator configures a transport-security allowlist.

Across the sample, three documentation paths clearly constrain or distinguish local execution from network deployment. TypeScript uses loopback binding with Host and Origin guards; Python rejects non-local Host values until configured; and C# uses localhost with adjacent Host and CORS warnings. The sampled Go path did not establish equivalent bind-address guidance.

The authorization tools are real—and deliberately separate

TypeScript documents a bearer-token gate that sits in front of an MCP route. The builder supplies a token verifier and required endpoint scopes; the verifier can use local JWT validation, token introspection, or an identity-provider call. Missing, malformed, or expired tokens receive a 401 response, while a valid token lacking a required endpoint scope receives 403.

Route access is only the first decision. The TypeScript guidance places permissions for individual tools inside their handlers, where code checks the verified caller’s scopes. It can also publish protected-resource metadata that directs an unauthenticated client toward an authorization server; the SDK acts as a resource server and does not issue tokens itself.

C# likewise requires an explicit step before authorization attributes on MCP tools, prompts, and resources take effect in its ASP.NET Core integration. Go’s Streamable HTTP example creates a handler and an HTTP test server without an authorization wrapper; its bearer-token protection is a separate RequireBearerToken middleware step.

The production transition still requires assembly

The missing link is not simply a middleware import. None of the four sampled starter flows puts token-audience validation, rules against token passthrough, credential storage, or credential rotation guidance beside the default server command. Those requirements sit in separate specification, security, or authentication material.

That makes the overall picture mixed rather than categorical. Official defaults provide meaningful limits on local-network exposure, while TypeScript, C#, and Go offer explicit mechanisms for bearer-token verification and authorization. Authentication and fine-grained tool access nevertheless remain opt-in in the mainstream starter HTTP code.

Readers evaluating the next iteration of MCP guidance should watch for whether a production-oriented default path brings these layers together: a real hostname allowlist, Origin handling, token verification, endpoint scopes, and distinct checks for sensitive tools. That would not remove the need for deployment-specific policy, but it would make the boundary between a local demo and a protected service much harder to miss.