mcp-server-auth

Make an MCP server authenticate its callers correctly. The spec profiles OAuth 2.1 precisely; the documented failures this skill fixes are servers that invent bearer-token schemes, pass client tokens through to downstream APIs, skip discovery metadata (so no client can connect), or accept any validly-signed token regardless of audience.

Targets spec revision 2025-11-25 (verified 2026-07-20): https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization.

When NOT to use

• Threat modeling / injection / sandboxing → mcp-server-security (auth is one control; that skill owns the attack taxonomy).
• Transport mechanics (Origin validation, sessions, headers) → mcp-server-implementation. Hosting/gateways → mcp-server-deployment.
• OAuth for ordinary web/mobile apps — this is the MCP profile specifically.