Source-backed rules for reviewing remote MCP server authorization boundaries: protected resource metadata, OAuth resource indicators, token audience checks, least-privilege scopes, and cross-server token isolation.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
0
63
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
No reviewed flag detected in metadata.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 24/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
No review metadata found; increase manual validation.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Missing required evidence: Metadata review. Risk score 31.
Source repository/provenance is listed.
Required in this preset
Review metadata is missing.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required gaps: Metadata review
Decision timeline
Blocking gaps: Check metadata review status. Risk 28.
triage
Source/provenance metadata is available.
triage
Review metadata is missing.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
Blockers: Check metadata review status
Prerequisite readiness
3 prerequisites to line up before setup. Have accounts and credentials ready first.
Safety & privacy surface
3 safety and 2 privacy notes across 2 risk areas. Review closely: credentials & tokens.
Remote MCP authorization review rules:
1. Require protected resource metadata discovery for the MCP endpoint.
2. Require an OAuth resource indicator tied to the exact MCP resource.
3. Reject tokens accepted for the wrong audience or another MCP server.
4. Verify scopes are narrow enough for the advertised tools.
5. Block forwarding incoming user tokens across MCP servers or backend services.
6. Document revocation, refresh, storage, and user consent behavior.
7. Keep source evidence public and credential details private.Remote MCP servers can expose account-scoped tools over HTTP transports. These rules keep review focused on the authorization boundary before the server is added to Claude or another MCP client. The goal is not to certify the whole service. The goal is to prevent obvious mistakes: wrong-audience tokens, missing protected resource metadata, broad scopes, unclear token forwarding, and unsafe account writes.
Collect these items before approving the server.
If the contributor cannot provide the resource metadata, authorization server, scope map, or public source evidence, mark the submission as incomplete.
Return a concise decision with:
The specification requires servers to return appropriate HTTP status codes for authorization errors. Confirm the server maps these correctly during review.
| Status Code | Description | Usage |
|---|---|---|
| 401 | Unauthorized | Authorization required or token invalid |
| 403 | Forbidden | Invalid scopes or insufficient permissions |
| 400 | Bad Request | Malformed authorization request |
A request without a token, or with an invalid or expired token, must receive an HTTP 401 with a WWW-Authenticate header pointing to the resource metadata URL. An authenticated request carries the token in the Authorization header, never in the URI query string:
GET /mcp HTTP/1.1
Host: mcp.example.com
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Show that MCP Remote Authorization Boundary Rules is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/rules/mcp-remote-authorization-boundary-rules)MCP Remote Authorization Boundary Rules side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
Next steps differ across entries — use the actions in the table below to copy install commands and source links per resource.
| Field | Source-backed rules for reviewing remote MCP server authorization boundaries: protected resource metadata, OAuth resource indicators, token audience checks, least-privilege scopes, and cross-server token isolation. Open dossier | Practical guide for checking MCP protected resource metadata, authorization server discovery, resource indicators, token audience binding, and 401 challenge behavior before trusting a remote MCP server. Open dossier | Source-backed collection for reviewing OAuth-backed and remote MCP servers: protected resource metadata, token audience checks, least-privilege scopes, config privacy, local tool access, and interactive server inspection. Open dossier | Slash command for auditing a remote MCP server authorization setup, including protected resource metadata, authorization server discovery, OAuth resource indicators, token audience validation, scopes, and token passthrough risk. Open dossier |
|---|---|---|---|---|
| Next stepsDiffers | ||||
| Trust | ||||
| Review status | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenance | Source-backed | Source-backed | Source-backed | Source-backed |
| Submitter | JSONbored | JSONbored | JSONbored | JSONbored |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | — |
| Category | rules | guides | collections | commands |
| Source | Source-backed | Source-backed | Source-backed | Source-backed |
| Author | JSONbored | JSONbored | JSONbored | JSONbored |
| Added | 2026-06-05 | 2026-06-05 | 2026-06-05 | 2026-06-05 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | ✓These rules do not execute the MCP server; they define review requirements before a server is connected to a real account. A server that accepts wrong-audience tokens, broad scopes, or forwarded user tokens should not be approved until the boundary is corrected. Use separate runtime testing before trusting any OAuth-backed tool that can write, delete, bill, publish, or modify account data. | ✓Never send a production user token to an MCP server until the resource metadata and token audience have been verified. Treat token passthrough, missing resource indicators, or acceptance of tokens issued for another resource as release-blocking. Do not paste bearer tokens into prompts, PR comments, issue comments, screenshots, or public logs while debugging MCP auth. | ✓This collection is a review workflow, not a guarantee that a remote MCP server is safe to connect to production accounts. Run write-capable, billing-capable, or deletion-capable MCP tools only in sandboxed accounts until scopes and confirmations are reviewed. Keep dynamic server inspection separate from source review; both can miss different failure modes. | ✓The command may ask the assistant to inspect authentication metadata and token-flow evidence; do not paste production bearer tokens into the prompt. Treat missing resource metadata, wrong-audience token acceptance, or token passthrough as blocking findings. |
| Privacy notes | ✓Authorization metadata, resource identifiers, issuer URLs, scopes, and token-audience notes can reveal account architecture. Do not paste access tokens, client secrets, refresh tokens, or internal tenant identifiers into public review comments. | ✓Authorization metadata can reveal tenant URLs, identity providers, scopes, client registration behavior, and internal endpoint names. Verification traces may include redirect URLs, state parameters, token claims, account IDs, or workspace identifiers; redact them before public sharing. | ✓Authorization metadata, issuer URLs, scopes, endpoint domains, tool names, and inspection traces can expose account architecture. Do not publish tokens, client secrets, refresh tokens, tenant identifiers, private endpoint URLs, or captured tool responses. | ✓Metadata and audit output can expose identity providers, scopes, tenant identifiers, redirect URLs, and private server URLs. Redact token claims and account identifiers before sharing command output publicly. |
| Prerequisites |
|
|
|
|
| Install | — | — | — | |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Source-backed guides for putting this to work.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.