{
  "schema": "longtermcapabilities-mcp-authorization-review/v1",
  "version": "1.64.0",
  "releaseId": "lts-1.64.0-upgrade-safe-rewrites-and-privacy-erasure-integrity",
  "generated": "2026-08-03T20:40:00Z",
  "reviewDate": "2026-08-01",
  "path": "/insights/mcp-authorization-and-security/",
  "specificationVersion": "2026-07-28",
  "checks": [
    {
      "id": "transport",
      "check": "Choose the authorization model by transport",
      "evidence": "HTTP authorization conforms to the current MCP authorization specification; STDIO credentials remain environment-scoped rather than copied into the protocol."
    },
    {
      "id": "issuer",
      "check": "Validate the authorization server relationship",
      "evidence": "Approved issuer metadata, exact HTTPS endpoints, key rotation, and failure behavior."
    },
    {
      "id": "audience",
      "check": "Require audience-bound access tokens",
      "evidence": "Server rejects tokens not intended for that MCP server and does not accept upstream API tokens as its own."
    },
    {
      "id": "passthrough",
      "check": "Prohibit token passthrough",
      "evidence": "Separate downstream authorization flow or service credential; adverse test confirms client tokens cannot be relayed to an upstream API."
    },
    {
      "id": "scope",
      "check": "Use progressive least-privilege scopes",
      "evidence": "Initial scope is minimal; step-up is explicit; denied calls are observable; unused privilege can be revoked."
    },
    {
      "id": "client",
      "check": "Bind client identity and redirect behavior",
      "evidence": "Registered client metadata, exact redirects, PKCE/state where applicable, and no open redirect."
    },
    {
      "id": "tool",
      "check": "Authorize the resource and operation, not only the server session",
      "evidence": "Per-tool/resource policy checks include tenant, purpose, amount, environment, and consequence limits."
    },
    {
      "id": "consent",
      "check": "Keep user consent and control explicit",
      "evidence": "User sees the requested capability, scope, destination, and consequence before delegation; revocation remains available."
    },
    {
      "id": "metadata",
      "check": "Treat tool metadata and remote descriptions as untrusted",
      "evidence": "Schema validation, reviewed registry, version pinning, and no policy decisions derived solely from descriptive text."
    },
    {
      "id": "audit",
      "check": "Correlate authorization to effects",
      "evidence": "Trace links principal, client, MCP server, policy decision, tool call, effect verification, expiry, and revocation."
    }
  ],
  "boundary": "Implementation review aid; protocol conformance does not replace application policy, tool safety, or effect verification."
}