355 pages for origin.
Titles and paths first, then pages whose text carries it. Each row opens that page as this site last read it.
Feature Lifecycle and Deprecation Policy
Model Context Protocol · in the page
community/feature-lifecycle
…#the-deprecated-registry). 3. A SEP is required for any change to the original deprecation or removal SEP, for example extending or shortening the timeline ([Expedited removal](#expedited-remova…
SEP Guidelines
Model Context Protocol · in the page
community/sep-guidelines
…wnership of SEPs to a new author. In general, we'd like to retain the original author as a co-author, but that's up to the original author. Good reasons to transfer ownership: * Original author no l…
SDK Working Group Charter
Model Context Protocol · in the page
community/working-groups/sdk
…ccepted SEPs and coordinates reference-implementation timing with the originating group. ## Leadership | Role | Name | Organization | GitHub | Term | | - | - | - | - | - | | Lead | Felix Weinberger…
Transports Charter
Model Context Protocol · in the page
community/working-groups/transports
…nsport Security**: Binding and envelope security requirements such as Origin validation, TLS, mTLS, and certificate handling, coordinated with the Security IG. Credential carriage is coordinated w…
Client Best Practices
Model Context Protocol · in the page
docs/2024-11-05/develop/clients/client-best-practices
…oses. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to direct calls (see [Tools: Security](/specification/2024-11-05/server/tools#security-considerati…
Understanding MCP servers
Model Context Protocol · in the page
docs/2024-11-05/learn/server-concepts
…lights", inputSchema: { type: "object", properties: { origin: { type: "string", description: "Departure city" }, destination: { type: "string", description: "Arrival city" },…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/2024-11-05/tutorials/security/authorization
…= Date.now() - start; console.log( `${req.method} ${req.originalUrl} -> ${res.statusCode} ${ms}ms`, ); }); next(); }; } const app = express(); app.use( express.json({…
Security Best Practices
Model Context Protocol · in the page
docs/2024-11-05/tutorials/security/security_best_practices
…to specific entities. This trust might include assumptions about origin or client behavior patterns. Breaking this trust boundary could lead to unexpected issues. * If the token is acce…
Client Best Practices
Model Context Protocol · in the page
docs/2025-03-26/develop/clients/client-best-practices
…oses. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to direct calls (see [Tools: Security](/specification/2025-03-26/server/tools#security-considerati…
Understanding MCP servers
Model Context Protocol · in the page
docs/2025-03-26/learn/server-concepts
…lights", inputSchema: { type: "object", properties: { origin: { type: "string", description: "Departure city" }, destination: { type: "string", description: "Arrival city" },…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/2025-03-26/tutorials/security/authorization
…= Date.now() - start; console.log( `${req.method} ${req.originalUrl} -> ${res.statusCode} ${ms}ms`, ); }); next(); }; } const app = express(); app.use( express.json({…
Security Best Practices
Model Context Protocol · in the page
docs/2025-03-26/tutorials/security/security_best_practices
…to specific entities. This trust might include assumptions about origin or client behavior patterns. Breaking this trust boundary could lead to unexpected issues. * If the token is acce…
Client Best Practices
Model Context Protocol · in the page
docs/2025-06-18/develop/clients/client-best-practices
…oses. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to direct calls (see [Tools: Security](/specification/2025-06-18/server/tools#security-considerati…
Understanding MCP servers
Model Context Protocol · in the page
docs/2025-06-18/learn/server-concepts
…lights", inputSchema: { type: "object", properties: { origin: { type: "string", description: "Departure city" }, destination: { type: "string", description: "Arrival city" },…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/2025-06-18/tutorials/security/authorization
…= Date.now() - start; console.log( `${req.method} ${req.originalUrl} -> ${res.statusCode} ${ms}ms`, ); }); next(); }; } const app = express(); app.use( express.json({…
Security Best Practices
Model Context Protocol · in the page
docs/2025-06-18/tutorials/security/security_best_practices
…to specific entities. This trust might include assumptions about origin or client behavior patterns. Breaking this trust boundary could lead to unexpected issues. * If the token is acce…
Client Best Practices
Model Context Protocol · in the page
docs/2025-11-25/develop/clients/client-best-practices
…oses. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to direct calls (see [Tools: Security](/specification/2025-11-25/server/tools#security-considerati…
Understanding MCP servers
Model Context Protocol · in the page
docs/2025-11-25/learn/server-concepts
…lights", inputSchema: { type: "object", properties: { origin: { type: "string", description: "Departure city" }, destination: { type: "string", description: "Arrival city" },…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/2025-11-25/tutorials/security/authorization
…= Date.now() - start; console.log( `${req.method} ${req.originalUrl} -> ${res.statusCode} ${ms}ms`, ); }); next(); }; } const app = express(); app.use( express.json({…
Security Best Practices
Model Context Protocol · in the page
docs/2025-11-25/tutorials/security/security_best_practices
…to specific entities. This trust might include assumptions about origin or client behavior patterns. Breaking this trust boundary could lead to unexpected issues. * If the token is acce…
Client Best Practices
Model Context Protocol · in the page
docs/2026-07-28/develop/clients/client-best-practices
…oses. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to direct calls (see [Tools: Security](/specification/2026-07-28/server/tools#security-considerati…
Understanding MCP clients
Model Context Protocol · in the page
docs/2026-07-28/learn/client-concepts
…tation/create` requests. The client gathers the input and retries the original request, attaching the collected `inputResponses` and echoing back any `requestState` the server included. **Elicitation…
Understanding MCP servers
Model Context Protocol · in the page
docs/2026-07-28/learn/server-concepts
…lights", inputSchema: { type: "object", properties: { origin: { type: "string", description: "Departure city" }, destination: { type: "string", description: "Arrival city" },…
Authorization
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/authorization
…The code is exchanged for tokens, the tokens are persisted, and the original connect is retried. For a [mid-session challenge](#mid-session-re-authorization), the CLI retries the refused request aut…
Configuration and flags
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/configuration
…card host (`0.0.0.0`, `::`, or any equivalent spelling). | | `ALLOWED_ORIGINS` | Comma-separated origin allow-list. **Replaces** the default list rather than merging. | | `MCP_PROXY_AUTH_TOKEN` | Depr…
Recipes
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/recipes
…``` > [!WARNING] > > **If you remap the published port, set `ALLOWED_ORIGINS`.** With `-p > 127.0.0.1:8080:6274` the browser's origin becomes `http://localhost:8080`, > which no longer matches th…
Security
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/security
…tect: * **The token is the real guard for non-browser clients.** The origin allow-list (`ALLOWED_ORIGINS`) stops other web pages from driving the backend, but a request that arrives with **no** `Orig…
Web client
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/web
…**Redirect URI** to copy into a pre-registered client (it follows the origin you opened the Inspector at), **Scopes** (space-separated), **Request refresh token**, **Revoke tokens on clear**, addition…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/2026-07-28/tutorials/security/authorization
…= Date.now() - start; console.log( `${req.method} ${req.originalUrl} -> ${res.statusCode} ${ms}ms`, ); }); next(); }; } const app = express(); app.use( express.json({…
Local Server Security
Model Context Protocol · in the page
docs/2026-07-28/tutorials/security/local-server-security
…thentication boundary: such > components need real authentication and origin validation, and they need > prompt updates when advisories land. **Going further**: give each server its own egress allowl…
Security Best Practices
Model Context Protocol · in the page
docs/2026-07-28/tutorials/security/security_best_practices
…ttps://www.rfc-editor.org/rfc/rfc9068.html)), it may accept tokens originally issued for other services. This breaks a fundamental OAuth security boundary, allowing attackers to reuse legitim…
Client Best Practices
Model Context Protocol · in the page
docs/draft/develop/clients/client-best-practices
…oses. Apply the same human-in-the-loop confirmation policy to sandbox-originated calls that you apply to direct calls (see [Tools: Security](/specification/draft/server/tools#security-considerations))…
Understanding MCP clients
Model Context Protocol · in the page
docs/draft/learn/client-concepts
…tation/create` requests. The client gathers the input and retries the original request, attaching the collected `inputResponses` and echoing back any `requestState` the server included. **Elicitation…
Understanding MCP servers
Model Context Protocol · in the page
docs/draft/learn/server-concepts
…lights", inputSchema: { type: "object", properties: { origin: { type: "string", description: "Departure city" }, destination: { type: "string", description: "Arrival city" },…
Authorization
Model Context Protocol · in the page
docs/draft/tools/inspector/authorization
…The code is exchanged for tokens, the tokens are persisted, and the original connect is retried. For a [mid-session challenge](#mid-session-re-authorization), the CLI retries the refused request aut…
Configuration and flags
Model Context Protocol · in the page
docs/draft/tools/inspector/configuration
…card host (`0.0.0.0`, `::`, or any equivalent spelling). | | `ALLOWED_ORIGINS` | Comma-separated origin allow-list. **Replaces** the default list rather than merging. | | `MCP_PROXY_AUTH_TOKEN` | Depr…
Recipes
Model Context Protocol · in the page
docs/draft/tools/inspector/recipes
…``` > [!WARNING] > > **If you remap the published port, set `ALLOWED_ORIGINS`.** With `-p > 127.0.0.1:8080:6274` the browser's origin becomes `http://localhost:8080`, > which no longer matches th…
Security
Model Context Protocol · in the page
docs/draft/tools/inspector/security
…tect: * **The token is the real guard for non-browser clients.** The origin allow-list (`ALLOWED_ORIGINS`) stops other web pages from driving the backend, but a request that arrives with **no** `Orig…
Web client
Model Context Protocol · in the page
docs/draft/tools/inspector/web
…**Redirect URI** to copy into a pre-registered client (it follows the origin you opened the Inspector at), **Scopes** (space-separated), **Request refresh token**, **Revoke tokens on clear**, addition…
Understanding Authorization in MCP
Model Context Protocol · in the page
docs/draft/tutorials/security/authorization
…= Date.now() - start; console.log( `${req.method} ${req.originalUrl} -> ${res.statusCode} ${ms}ms`, ); }); next(); }; } const app = express(); app.use( express.json({…
Local Server Security
Model Context Protocol · in the page
docs/draft/tutorials/security/local-server-security
…thentication boundary: such > components need real authentication and origin validation, and they need > prompt updates when advisories land. **Going further**: give each server its own egress allowl…
Security Best Practices
Model Context Protocol · in the page
docs/draft/tutorials/security/security_best_practices
…ttps://www.rfc-editor.org/rfc/rfc9068.html)), it may accept tokens originally issued for other services. This breaks a fundamental OAuth security boundary, allowing attackers to reuse legitim…
MCP Apps
Model Context Protocol · in the page
extensions/apps/overview
…simplicity. Apps can also load external scripts and resources from origins specified in `_meta.ui.csp`. 3. **Sandboxed rendering**: Web hosts typically render the HTML inside a sandboxed [if…
Enterprise-Managed Authorization
Model Context Protocol · in the page
extensions/auth/enterprise-managed-authorization
…](/seps/990-enable-enterprise-idp-policy-controls-during-mcp-o)** > > Original proposal: Enable Enterprise IdP Policy Controls > **[MCP Authorization](/specification/latest/basic/authorization)** > >…
Skills
Model Context Protocol · in the page
extensions/skills/overview
…hey do not provide content integrity. Skill identity consists of the originating server's identity and the skill URI. Names are labels and are not guaranteed to be unique. Hosts **MUST** preserve bot…
Tasks
Model Context Protocol · in the page
extensions/tasks/overview
…e status reaches `completed`, the `result` field contains what the original request would have returned synchronously. If the status is `failed`, the `error` field contains the JSON-RPC error.…
How to Automate Publishing with GitHub Actions
Model Context Protocol · in the page
registry/github-actions
…o trigger the workflow: ```bash theme={null} git tag v1.0.0 git push origin v1.0.0 ``` The workflow will run tests, build the package, publish the package to npm, and publish the server to the MCP R…
SEP-1034: Support default values for all primitive types in elicitation schemas
Model Context Protocol · in the page
seps/1034--support-default-values-for-all-primitive-types-in
…[str] = "" ) -> None: # Code can lookup the participants from the original thread # and prepare an elicitation request with the defaults setup ``` ```typescript theme={null} const response =…
SEP-1036: URL Mode Elicitation for secure out-of-band interactions
Model Context Protocol · in the page
seps/1036-url-mode-elicitation-for-secure-out-of-band-intera
…notification **MUST** include the `elicitationId` established in the original `elicitation/create` request. * Clients **MUST** ignore notifications referencing unknown or already-completed IDs. * If…
SEP-1046: Support OAuth client credentials flow in authorization
Model Context Protocol · in the page
seps/1046-support-oauth-client-credentials-flow-in-authoriza
…ion spec to enable machine-to-machine scenarios. ### Motivation The original authorization spec mentioned the client credentials flow, but it was dropped in subsequent revisions. Therefore, the spec…