Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

Summary

In affected versions, the SDK's server-side bearer authentication had no way to check that a token was issued for your server (its audience). Where one authorization server issues tokens for several services, a valid token for another service was also accepted by your MCP server.

Am I affected?

Yes, if your HTTP server uses the SDK's bearer authentication (auth=AuthSettings(...) with token_verifier=), its authorization server also issues tokens for other services, and your TokenVerifier does not check the token's audience (aud) itself.

Affected versions:

• mcp 1.10.0 through 1.29.1
• mcp 2.0.0 through 2.1.1

Fix

Upgrade to:

• 1.x: mcp 1.30.0 or later
• 2.x: mcp 2.2.0 or later

Upgrading alone changes nothing. The patched versions add a validate_token_resource setting that is off unless you set it. To turn the check on, make both of these changes together:

1. Set validate_token_resource=True in AuthSettings, with resource_server_url set to the audience your authorization server puts in tokens for your server.
2. Return the token's audience from verify_token() as AccessToken.resource.

A token for another service then gets 401. With only the first change, every request gets 401.

If your TokenVerifier already checks the audience, set validate_token_resource=False to silence the deprecation warning. The setting will default to True in 3.0.