A developer starts an MCP server on a laptop. It works over a local connection, so authentication never becomes part of the setup. Later, the team exposes it over HTTP so other agents can use it.
The deployment has changed. The server now needs a way to decide which callers it should trust.
Three failures worth reading together
The Bifrost advisory describes a management API that could register a stdio client and start its command when authentication was disabled. The capability behind that API was process execution, even though the request looked like routine configuration.
The Grafana MCP chain reached a different boundary: a correctly shaped session identifier was accepted without proving the server had issued it. That opened a route to requests made from the server's network position.
In the MKP memory-exhaustion flaw, a reachable endpoint exposed a tool whose output could consume substantial memory.
These cases have different impacts. Together, they make a useful review question concrete: what can an anonymous caller cause before the service checks identity?
Walk the request backward
Begin at the side effect. A command starts, a downstream connection opens, or a costly log fetch begins. Find the authorization decision immediately before it. Then follow the request back to the point where a validated credential established the caller's identity.
Transport limits apply from the first byte. Caller identity and tool permission must be established before privileged work starts.
The server still needs to parse enough of the request to authenticate it. Keep that preliminary work bounded. Avoid creating persistent sessions, returning sensitive tool metadata, or starting downstream work for a caller that has not passed the relevant checks.
A session identifier is routing state. It should be server-issued and bound to the authenticated caller, but it should never replace that caller's credential.
One test that changes the conversation
Send the same sensitive request with no token, an expired token, and a token issued for a different audience. Observe the whole system, including session stores, tool logs, and downstream traffic.
The useful result is more specific than an HTTP 401. It is evidence that rejection happened before a process launched, a session persisted, or a privileged network call began.
Repeat with a valid user who lacks permission for the requested tool. Authentication can succeed while authorization correctly denies the action.
Before enabling a shared MCP endpoint, assign an owner to both decisions. The network team may control who can connect. The service owner still needs to control which tools each connected identity can invoke.