Client / Server Authentication?

[timothyerwin]

I'm aware of custom protocol handlers, but I was hoping some basic auth like HTTP headers or something in the SDKs would have this by default?

Most of the examples seem to just have an open server with no auth? Anyone have an example how authentication should happen?

[Chrisbattarbee]

Also wondering about this. In this architecture diagram, there's an MCP server on the internet: https://spec.modelcontextprotocol.io/specification/architecture/#core-components

Without some authentication mechanism, it doesn't seem possible to have a single mcp server accept connections from multiple mcp clients so I'm not sure how that architecture can be achieved?

Currently it seems like the only way of operating an mcp based system is to have a 1-1 relationship between the client and the server where the server has a secret specifically for the only client connecting to it. Would love to be corrected if that's not true!

[daikw]

I experimented with implementing a transport layer that uses Basic Authentication:
https://github.com/daikw/mcp-transport-auth

TIPS: I ran into the issue described in #83, but the comment in the following link helped me resolve it:
#83 (review)

[dsp-ant]

There is no defined Authentication in the protocol. See modelcontextprotocol/modelcontextprotocol#64 for an ongoing discussion on Authentication. If you are doing MCP over a stateful HTTP connection across servers, you need to solve authentication yourself for now. We are thinking about best to solve this, so the discussion is the right place.

Since it overlaps with the existing discussion, I'll close the issue.