581 pages for credentials.

Specification Enhancement Proposals (SEPs) Model Context Protocol · in the page seps/index …-1046](https://modelcontextprotocol.io/seps/1046-support-oauth-client-credentials-flow-in-authoriza.md) | Support OAuth client credentials flow in authorization | Final | Standards Track | 2025-07-23… Logging Model Context Protocol · in the page specification/2024-11-05/server/utilities/logging …log messages ## Security 1. Log messages **MUST NOT** contain: * Credentials or secrets * Personal identifying information * Internal system details that could aid attacks 2. Implementatio… Authorization Model Context Protocol · in the page specification/2025-03-26/basic/authorization …port **SHOULD NOT** follow this specification, and instead retrieve credentials from the environment. * Implementations using alternative transports **MUST** follow established security best pract… Overview Model Context Protocol · in the page specification/2025-03-26/basic/index …nsport **SHOULD NOT** follow this specification, and instead retrieve credentials from the environment. Additionally, clients and servers **MAY** negotiate their own custom authentication and authori… Logging Model Context Protocol · in the page specification/2025-03-26/server/utilities/logging …log messages ## Security 1. Log messages **MUST NOT** contain: * Credentials or secrets * Personal identifying information * Internal system details that could aid attacks 2. Implementatio… Authorization Model Context Protocol · in the page specification/2025-06-18/basic/authorization …port **SHOULD NOT** follow this specification, and instead retrieve credentials from the environment. * Implementations using alternative transports **MUST** follow established security best pract… Overview Model Context Protocol · in the page specification/2025-06-18/basic/index …nsport **SHOULD NOT** follow this specification, and instead retrieve credentials from the environment. Additionally, clients and servers **MAY** negotiate their own custom authentication and authori… Logging Model Context Protocol · in the page specification/2025-06-18/server/utilities/logging …log messages ## Security 1. Log messages **MUST NOT** contain: * Credentials or secrets * Personal identifying information * Internal system details that could aid attacks 2. Implementatio… Authorization Model Context Protocol · in the page specification/2025-11-25/basic/authorization …port **SHOULD NOT** follow this specification, and instead retrieve credentials from the environment. * Implementations using alternative transports **MUST** follow established security best pract… Overview Model Context Protocol · in the page specification/2025-11-25/basic/index …nsport **SHOULD NOT** follow this specification, and instead retrieve credentials from the environment. Additionally, clients and servers **MAY** negotiate their own custom authentication and authori… Elicitation Model Context Protocol · in the page specification/2025-11-25/client/elicitation …nformation such as > passwords, API keys, access tokens, or payment credentials > * Servers **MUST** use [URL mode](#url-mode-elicitation-requests) for interactions involving > such sensitive info… Logging Model Context Protocol · in the page specification/2025-11-25/server/utilities/logging …log messages ## Security 1. Log messages **MUST NOT** contain: * Credentials or secrets * Personal identifying information * Internal system details that could aid attacks 2. Implementatio… Authorization Server Discovery Model Context Protocol · in the page specification/2026-07-28/basic/authorization/authorization-server-discovery …d them. Clients **MUST** maintain separate registration state (client credentials, tokens) per authorization server and **MUST NOT** assume that credentials valid for one authorization server will be… Client Registration Model Context Protocol · in the page specification/2026-07-28/basic/authorization/client-registration …Server->>User: Authentication prompt User->>Server: Provides credentials Note over Server: Authenticates user Note over Server: Detects URL-formatted client_id Server->>Metadata… Authorization Model Context Protocol · in the page specification/2026-07-28/basic/authorization/index …port **SHOULD NOT** follow this specification, and instead retrieve credentials from the environment. * Implementations using alternative transports **MUST** follow established security best pract… Overview Model Context Protocol · in the page specification/2026-07-28/basic/index …nsport **SHOULD NOT** follow this specification, and instead retrieve credentials from the environment. Additionally, clients and servers **MAY** negotiate their own custom authentication and authori… Key Changes Model Context Protocol · in the page specification/2026-07-28/changelog …ntextprotocol/modelcontextprotocol/pull/837)). 9. Clarify that client credentials are bound to the authorization server that issued them: clients **MUST** key persisted credentials by the issuer id… Elicitation Model Context Protocol · in the page specification/2026-07-28/client/elicitation …nformation such as > passwords, API keys, access tokens, or payment credentials > * Servers **MUST** use [URL mode](#url-mode-elicitation-requests) for interactions involving > such sensitive info… Prompts Model Context Protocol · in the page specification/2026-07-28/server/prompts …returning only the prompts the caller's granted scopes permit — since credentials are per-request input, not connection state. ## Protocol Messages ### Listing Prompts To retrieve available prompts… Resources Model Context Protocol · in the page specification/2026-07-28/server/resources …turning only the resources the caller's granted scopes permit — since credentials are per-request input, not connection state. ## Protocol Messages ### Listing Resources To discover available resou… Tools Model Context Protocol · in the page specification/2026-07-28/server/tools …, returning only the tools the caller's granted scopes permit — since credentials are per-request input, not connection state. Servers **SHOULD** return tools in a deterministic order (i.e., the same… Logging Model Context Protocol · in the page specification/2026-07-28/server/utilities/logging …log messages ## Security 1. Log messages **MUST NOT** contain: * Credentials or secrets * Personal identifying information * Internal system details that could aid attacks 2. Implementatio… Authorization Server Discovery Model Context Protocol · in the page specification/draft/basic/authorization/authorization-server-discovery …d them. Clients **MUST** maintain separate registration state (client credentials, tokens) per authorization server and **MUST NOT** assume that credentials valid for one authorization server will be… Client Registration Model Context Protocol · in the page specification/draft/basic/authorization/client-registration …Server->>User: Authentication prompt User->>Server: Provides credentials Note over Server: Authenticates user Note over Server: Detects URL-formatted client_id Server->>Metadata… Authorization Model Context Protocol · in the page specification/draft/basic/authorization/index …port **SHOULD NOT** follow this specification, and instead retrieve credentials from the environment. * Implementations using alternative transports **MUST** follow established security best pract… Overview Model Context Protocol · in the page specification/draft/basic/index …nsport **SHOULD NOT** follow this specification, and instead retrieve credentials from the environment. Additionally, clients and servers **MAY** negotiate their own custom authentication and authori… Elicitation Model Context Protocol · in the page specification/draft/client/elicitation …nformation such as > passwords, API keys, access tokens, or payment credentials > * Servers **MUST** use [URL mode](#url-mode-elicitation-requests) for interactions involving > such sensitive info… Prompts Model Context Protocol · in the page specification/draft/server/prompts …returning only the prompts the caller's granted scopes permit — since credentials are per-request input, not connection state. ## Protocol Messages ### Listing Prompts To retrieve available prompts… Resources Model Context Protocol · in the page specification/draft/server/resources …turning only the resources the caller's granted scopes permit — since credentials are per-request input, not connection state. ## Protocol Messages ### Listing Resources To discover available resou… Tools Model Context Protocol · in the page specification/draft/server/tools …, returning only the tools the caller's granted scopes permit — since credentials are per-request input, not connection state. Servers **SHOULD** return tools in a deterministic order (i.e., the same… Logging Model Context Protocol · in the page specification/draft/server/utilities/logging …log messages ## Security 1. Log messages **MUST NOT** contain: * Credentials or secrets * Personal identifying information * Internal system details that could aid attacks 2. Implementatio…