Research investigation R0906 / policy impact
MCP’s Optional-Authorization Reality Check
The saved evidence indicates a gap between MCP’s security guidance and its mainstream starter HTTP flows: authorization capabilities and security requirements exist, but authentication and scoped authorization are opt-in in the four sampled Tier-1 SDK paths.
The matrix supports these rows: authorization default (0 of 4 sampled starter HTTP examples enabled authentication or scoped authorization); opt-in authorization capability (established for TypeScript, C#, and Go); local/network safeguards (clearly established in three sampled paths); and credential-security guidance beside default commands (not found in the four sampled starter HTTP flows).
The matrix supports these rows: authorization default (0 of 4 sampled starter HTTP examples enabled authentication or scoped authorization); opt-in authorization capability (established for TypeScript, C#, and Go); local/network safeguards (clearly established in three sampled paths); and credential-security guidance beside default commands (not found in the four sampled starter HTTP flows).
- Dataset ID
- spd:mcp-s-optional-authorization-reality-check-ee36f875
- Stable URL
- /research/mcp-s-optional-authorization-reality-check-ee36f875
- Version
- Live
- Coverage
- Live collection
- Records
- 0
- Fields
- 7
- Updated
| Entity | Metric | Value | Unit | Observed | Source | Transform |
|---|
Measurement technique
How to read this report
- 01Evidence matrix plan: compare the saved specification, security guidance, and one sampled starter HTTP documentation path for each Tier-1 SDK across default authentication, scoped authorization, local/network boundary guidance, and proximity of credential-handling warnings.
- 02Treat documented defaults rather than inferred runtime behavior as the unit of analysis.
- 03Use the saved four-SDK sample only: TypeScript, Python, C#, and Go.
- 04Record absence only within sampled starter flows; distinguish it from documentation that may exist elsewhere.
- 05Collection cutoff: saved evidence was originally collected on 2026-09-06. This synthesis reassesses saved evidence only and is not new collection or execution.
Sources
Evidence
4 publishers supporting 0 records. Expand a publisher to inspect its cited pages.