Role-Based Access Control (RBAC) for MCP Servers

Security Recommendation

MCP servers SHOULD implement RBAC as a defense-in-depth layer by mapping token claims to internal application roles. This adds authorization beyond what OAuth scopes alone provide.

How It Works

1. The IdP issues a token with claims (e.g., roles, groups, or custom claims)
2. The MCP server maps those claims to internal roles
3. Internal roles determine which tools and operations are available

Example Token-to-Role Mapping