No Credential Forwarding in MCP Servers

Security Requirement

MCP servers MUST NOT forward any credentials or authentication tokens received from users to downstream tools or third-party APIs. This is explicitly forbidden by the MCP specification and has a high security impact.

Risks of Credential Forwarding

• Token leakage: User tokens exposed to third-party services
• Confused deputy attacks: Third-party services may use the user's token to access resources beyond what the MCP server intended
• Excessive privilege: Downstream tools receive user-level access when they only need scoped tool-level access
• Audit trail corruption: Actions performed by tools are attributed to the user instead of the MCP server

Required Approach

Instead of forwarding user tokens, MCP servers MUST obtain separate credentials for downstream services through one of: