From a87e040d3306f257bc2a9987f60a443db68920cd Mon Sep 17 00:00:00 2001 From: Aaron Parecki Date: Thu, 23 Oct 2025 11:45:36 -0700 Subject: [PATCH 1/9] link to extensions from main authorization page --- docs/specification/draft/basic/authorization.mdx | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index 73eb74080..85239090e 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -530,3 +530,18 @@ MCP clients **MUST** implement and use the `resource` parameter as defined in [R to explicitly specify the target resource for which the token is being requested. This requirement aligns with the recommendation in [RFC 9728 Section 7.4](https://datatracker.ietf.org/doc/html/rfc9728#section-7.4). This ensures that access tokens are bound to their intended resources and cannot be misused across different services. + +## MCP Authorization Extensions + +There are several authorization extensions to the core protocol that define additional authorization mechanisms. These extensions are: + +* **Optional** - Implementations can choose to adopt these extensions +* **Additive** - Extensions do not modify or break core protocol functionality; they add new capabilities while preserving core protocol behavior +* **Composable** - Extensions are modular and designed to work together without conflicts, allowing implementations to adopt multiple extensions simultaneously +* **Versioned independently** - Extensions follow the core MCP versioning cycle but may adopt independent versioning as needed + +A list of supported extensions can be found here: + + + + From 9b4473a538c563a4b28db24ac1ace60b4b96d3ff Mon Sep 17 00:00:00 2001 From: Aaron Parecki Date: Thu, 23 Oct 2025 11:50:04 -0700 Subject: [PATCH 2/9] fix link syntax --- docs/specification/draft/basic/authorization.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index 85239090e..fce22d5c0 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -542,6 +542,6 @@ There are several authorization extensions to the core protocol that define addi A list of supported extensions can be found here: - +[modelcontextprotocol/ext-auth](https://github.com/modelcontextprotocol/ext-auth) From afd0ac8df5e044b0998fdd75df859dcb9ebd3101 Mon Sep 17 00:00:00 2001 From: Aaron Parecki Date: Fri, 24 Oct 2025 09:31:42 -0700 Subject: [PATCH 3/9] fix list syntax --- docs/specification/draft/basic/authorization.mdx | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index fce22d5c0..daca176ea 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -535,10 +535,10 @@ cannot be misused across different services. There are several authorization extensions to the core protocol that define additional authorization mechanisms. These extensions are: -* **Optional** - Implementations can choose to adopt these extensions -* **Additive** - Extensions do not modify or break core protocol functionality; they add new capabilities while preserving core protocol behavior -* **Composable** - Extensions are modular and designed to work together without conflicts, allowing implementations to adopt multiple extensions simultaneously -* **Versioned independently** - Extensions follow the core MCP versioning cycle but may adopt independent versioning as needed +- **Optional** - Implementations can choose to adopt these extensions +- **Additive** - Extensions do not modify or break core protocol functionality; they add new capabilities while preserving core protocol behavior +- **Composable** - Extensions are modular and designed to work together without conflicts, allowing implementations to adopt multiple extensions simultaneously +- **Versioned independently** - Extensions follow the core MCP versioning cycle but may adopt independent versioning as needed A list of supported extensions can be found here: From 5cfc5bc33bd5ac4c1d78be3feb5b78ec2fdcbf8b Mon Sep 17 00:00:00 2001 From: Aaron Parecki Date: Fri, 24 Oct 2025 09:33:48 -0700 Subject: [PATCH 4/9] rm extra newlines --- docs/specification/draft/basic/authorization.mdx | 2 -- 1 file changed, 2 deletions(-) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index daca176ea..37ec72434 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -543,5 +543,3 @@ There are several authorization extensions to the core protocol that define addi A list of supported extensions can be found here: [modelcontextprotocol/ext-auth](https://github.com/modelcontextprotocol/ext-auth) - - From bead0c018210531bb38e41e5b0dc78c342ab9331 Mon Sep 17 00:00:00 2001 From: Aaron Parecki Date: Wed, 12 Nov 2025 15:10:13 -0800 Subject: [PATCH 5/9] Update docs/specification/draft/basic/authorization.mdx Co-authored-by: Den Delimarsky --- docs/specification/draft/basic/authorization.mdx | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index 37ec72434..f0d4b3904 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -540,6 +540,6 @@ There are several authorization extensions to the core protocol that define addi - **Composable** - Extensions are modular and designed to work together without conflicts, allowing implementations to adopt multiple extensions simultaneously - **Versioned independently** - Extensions follow the core MCP versioning cycle but may adopt independent versioning as needed -A list of supported extensions can be found here: +A list of supported extensions can be found in the [MCP Authorization Extensions](https://github.com/modelcontextprotocol/ext-auth) repository. [modelcontextprotocol/ext-auth](https://github.com/modelcontextprotocol/ext-auth) From 76dc6fa474eb5f26b6e95d2042905abeb2b7b492 Mon Sep 17 00:00:00 2001 From: Aaron Parecki Date: Wed, 12 Nov 2025 15:10:24 -0800 Subject: [PATCH 6/9] Update docs/specification/draft/basic/authorization.mdx Co-authored-by: Den Delimarsky --- docs/specification/draft/basic/authorization.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index f0d4b3904..95739c768 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -542,4 +542,3 @@ There are several authorization extensions to the core protocol that define addi A list of supported extensions can be found in the [MCP Authorization Extensions](https://github.com/modelcontextprotocol/ext-auth) repository. -[modelcontextprotocol/ext-auth](https://github.com/modelcontextprotocol/ext-auth) From 4e3e8d1d0505b49c5fecb97def7a15d9663c7916 Mon Sep 17 00:00:00 2001 From: "den (work)" <53200638+localden@users.noreply.github.com> Date: Fri, 14 Nov 2025 16:08:37 -0800 Subject: [PATCH 7/9] Update authorization.mdx --- docs/specification/draft/basic/authorization.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index 95739c768..420e5d4d8 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -541,4 +541,3 @@ There are several authorization extensions to the core protocol that define addi - **Versioned independently** - Extensions follow the core MCP versioning cycle but may adopt independent versioning as needed A list of supported extensions can be found in the [MCP Authorization Extensions](https://github.com/modelcontextprotocol/ext-auth) repository. - From 1739c6af8828c922fe61e21c59f1b41b75bb266e Mon Sep 17 00:00:00 2001 From: Aaron Parecki Date: Fri, 14 Nov 2025 16:11:11 -0800 Subject: [PATCH 8/9] Apply suggestion from @aaronpk --- docs/specification/draft/basic/authorization.mdx | 1 + 1 file changed, 1 insertion(+) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index 9a6e6887c..55481ab91 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -714,3 +714,4 @@ There are several authorization extensions to the core protocol that define addi - **Versioned independently** - Extensions follow the core MCP versioning cycle but may adopt independent versioning as needed A list of supported extensions can be found in the [MCP Authorization Extensions](https://github.com/modelcontextprotocol/ext-auth) repository. + From 162818b785b61f3a24b1921cd511c30df7c026cf Mon Sep 17 00:00:00 2001 From: Aaron Parecki Date: Fri, 14 Nov 2025 16:12:24 -0800 Subject: [PATCH 9/9] Apply suggestion from @aaronpk --- docs/specification/draft/basic/authorization.mdx | 1 - 1 file changed, 1 deletion(-) diff --git a/docs/specification/draft/basic/authorization.mdx b/docs/specification/draft/basic/authorization.mdx index 55481ab91..9a6e6887c 100644 --- a/docs/specification/draft/basic/authorization.mdx +++ b/docs/specification/draft/basic/authorization.mdx @@ -714,4 +714,3 @@ There are several authorization extensions to the core protocol that define addi - **Versioned independently** - Extensions follow the core MCP versioning cycle but may adopt independent versioning as needed A list of supported extensions can be found in the [MCP Authorization Extensions](https://github.com/modelcontextprotocol/ext-auth) repository. -