How MCP Servers Handle Authentication (And Where They Get It Wrong)

How MCP Servers Handle Authentication (And Where They Get It Wrong) Authentication is one of the most frequently mishandled aspects of MCP server design. I've reviewed dozens of open-source servers and the same mistakes appear repeatedly. Here's what correct MCP authentication looks like — and the patterns that create security vulnerabilities. The Authentication Problem Space MCP servers face three distinct authentication challenges: Authenticating callers — verifying that the Claude Code session connecting to your server is authorized Authenticating to external services — securely using API keys to call third-party APIs Authorizing tool calls — ensuring specific tools can only be called with sufficient permissions Most tutorials only address #2, and often do it wrong. Problem 1: MCP Server Has No Caller Authentication The MCP spec doesn't mandate caller authentication. By default, any process that can reach your MCP server can call its tools. For locally-running MCP servers (connected