Follow Discord
Sweep 22 Oct 2026 · 21:04Z Build v2.1.309 528 read Stable v2.1.308 Latest v2.1.309 Next v2.1.309 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsModel Context Protocol 29 Jul 2026
One change · mcp

SEP-2468: Recommend Issuer (iss) Parameter in MCP Auth Responses changedseps/2468-recommend-issuer-claim-for-auth

Upstream edited this page at 29 Jul 2026 22:46 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 22 Oct 2026 20:37 UTC.

Upstream edited
Recorded here
Lines+2added
Lines−2removed
From line 11 where the diff opens
First seen 14 Aug 2026 this site's first read of the page
Recorded edits4to this page, all time

The whole hunk

from line 11, old and new numbered
/
lines
from line 11
1111> This SEP has reached Final status and is preserved as a historical record of
1212> the design as accepted. Changes made to the protocol after finalization are
1313> not reflected here. Refer to the [current
14> specification](/specification/latest) and its changelog for authoritative
14> specification](/specification/latest.md) and its changelog for authoritative
1515> requirements.
1616 
1717| Field | Value |
from line 88
8888 
8989## Security Implications
9090 
91This proposal is a mitigation against mix-up attacks; the security considerations for the mechanism itself are documented in [RFC9207 Section 4](https://datatracker.ietf.org/doc/html/rfc9207#section-4). In particular, the mitigation depends on clients establishing the expected issuer before redirecting and on the comparison being an exact simple string comparison. See also the MCP [security best practices](/docs/tutorials/security/security_best_practices).
91This proposal is a mitigation against mix-up attacks; the security considerations for the mechanism itself are documented in [RFC9207 Section 4](https://datatracker.ietf.org/doc/html/rfc9207#section-4). In particular, the mitigation depends on clients establishing the expected issuer before redirecting and on the comparison being an exact simple string comparison. See also the MCP [security best practices](/docs/tutorials/security/security_best_practices.md).
9292 
9393## Reference Implementation
9494 
Feedback