MCP token passthrough risk

A token issued for an MCP server must not be forwarded as if it also authorizes a downstream API.

01 / The operating case

What changes in a real workflow?

An MCP server receives a client token for its own resource, then passes that bearer token to a payment API.

Trace the authority boundary
  1. 01Client / task
  2. 02MCP server
  3. 03Tool call + arguments
  4. 04Downstream effect

02 / Decision contract

What the executor must check

Validate the incoming token for the MCP resource; use a separately authorized downstream credential or delegation flow with the payment API as audience.

InputPrincipal · task · action · target
DecisionGrant ancestry · policy · current state
ResultEnforce · record · verify outcome

03 / Failure and evidence

What goes wrong, and what can be proven?

Failure mode

The downstream API mistakes transport access to the server for permission to make payments.

Evidence to retain

Trace incoming audience, downstream credential source, payment decision and effect without storing either token.

04 / Canonical scope

Why this reference stands alone

Audience validation checks receipt at a server; this page follows the improper forwarding path beyond it.

Protocol or attack trace

Two-audience check

Sequence

Client token has audience MCP-server. Server uses it as Authorization header for billing-API.

Negative test

Billing API must reject the MCP audience; server must obtain separate billing-scoped authority before a charge.

Primary references

Read the underlying material

Architecture discussion

Choose one consequential action and make its boundary explicit.

Request a Conversation