Follow Discord
Sweep 10 Nov 2026 · 02:18Z Build v2.1.322 539 read Stable v2.1.311 Latest v2.1.322 Next v2.1.322 Feeds RSS JSON llms.txt llms-full.txt Unofficial
HomeDocsModel Context Protocol 9 Nov 2026
One change · mcp

Authorization Security Considerations changedspecification/draft/basic/authorization/security-considerations

Nearest release: v2.1.321, published 16 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 9 Nov 2026 03:02 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 9 Nov 2026 03:07 UTC.

Upstream edited
Recorded here
Lines+3added
Lines−3removed
From line 77 where the diff opens
First seen 26 Aug 2026 this site's first read of the page
Recorded edits5to this page, all time

The whole hunk

from line 77, old and new numbered
/
lines
from line 77
7777## Client ID Metadata Document Security
7878 
7979When implementing [Client ID Metadata Documents](https://modelcontextprotocol.io/specification/draft/basic/authorization/client-registration.md#client-id-metadata-documents), authorization servers **MUST** consider the security implications
80detailed in [OAuth Client ID Metadata Document, Section 6](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00#name-security-considerations).
80detailed in [OAuth Client ID Metadata Document, Section 10](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-03#name-security-considerations).
8181Key considerations include:
8282 
8383### Authorization Server Abuse Protection
8484 
8585Authorization servers fetching metadata documents **SHOULD** consider
86[Server-Side Request Forgery (SSRF)](https://developer.mozilla.org/docs/Web/Security/Attacks/SSRF) risks, as described in [OAuth Client ID Metadata Document: Server Side Request Forgery (SSRF) Attacks](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-00#name-server-side-request-forgery).
86[Server-Side Request Forgery (SSRF)](https://developer.mozilla.org/docs/Web/Security/Attacks/SSRF) risks, as described in [OAuth Client ID Metadata Document: Server Side Request Forgery (SSRF) Attacks](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-client-id-metadata-document-03#name-server-side-request-forgery).
8787 
8888### Localhost Redirect URI Risks
8989 
from line 97
9797 
9898### Trust Policies
9999 
100Authorization servers **MAY** implement domain-based trust policies for accepting Client ID Metadata Documents, as described in [Section 6.4](https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html#section-6.4) and [Section 6.8](https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html#section-6.8) of the Client ID Metadata Document specification.
100Authorization servers **MAY** implement domain-based trust policies for accepting Client ID Metadata Documents, as described in [Section 10.6](https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-03.html#section-10.6) and [Section 10.8](https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-03.html#section-10.8) of the Client ID Metadata Document specification.
101101 
102102## Confused Deputy Problem
103103 
Feedback