How does the confused deputy problem manifest in MCP with an OAuth misconfiguration?

Attempt it

Explain how the confused deputy problem arises in MCP and describe a specific OAuth 2.1 misconfiguration that enables privilege escalation.

Free · 2 AI evals / day

Quick reference

TL;DR

A confused deputy is an MCP server with broad delegated authority tricked into acting for an attacker; defend with per-user consent, audience-bound tokens, least privilege, and no token passthrough.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Picture a hotel valet holding the master key to every car in the lot. You hand him your ticket and he fetches your car. Now a stranger hands him a forged ticket. The valet cannot tell the difference, so he happily drives off in someone else's car. The valet is not a thief. He is confused. He has far more authority than any single guest, and he acts on whoever asks. An MCP server is that valet. It holds powerful credentials and acts on behalf of users, so if its checks are sloppy, an attacker can borrow that power. The defense is making the valet verify each request truly belongs to the person it claims to serve, and never handing him the master key in the first place.

Key concepts

Confused deputy problem OAuth 2.1 authorization Least privilege Audience-bound tokens

Quick scan · 2–4 min

Everything important, quickly.

6 min: define confused deputy, map it onto an MCP server's ambient authority, walk the PKCE-skip escalation, then cover the four defenses: per-user consent, audience-bound tokens, least privilege, and no token passthrough.

Side-by-side

Defense	What it stops	Failure if skipped
PKCE enforcement	Authorization-code interception and replay	Attacker redeems stolen code for the server's scope
Audience-bound tokens	Token replay across resources and passthrough abuse	A token minted for one API is accepted by another
Per-user consent	Shared ambient authority across all users	One grant silently serves every requester
Least-privilege scopes	Blast radius of any successful trick	A single confused call yields admin-level access
No token passthrough	Downstream services becoming the next deputy	Backend acts on a scope it never validated

Real-world examples

Real products, models, and research that use this idea.

The 2025 OAuth update to the MCP spec added audience-bound tokens and explicit no-passthrough guidance after confused-deputy reports.
OWASP's MCP Top 10, published in 2025, lists excessive agent authority and token misuse as headline risks for deployments.
Remote MCP servers fronting GitHub, Slack, or Postgres act as deputies whose service credentials dwarf any one user's intended scope.
Hosts like Claude Desktop and Cursor gate side-effectful MCP tool calls behind per-call human approval as a deputy backstop.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QWhy does audience binding, not just PKCE, defeat the token passthrough variant of the confused deputy?

Sign in or go Pro to see the approach for this follow-up.

QHow would you design per-user consent so an MCP server never relies on one shared ambient grant?

Sign in or go Pro to see the approach for this follow-up.

QAn MCP server must call a backend that only issues coarse admin tokens. How do you limit the blast radius?

Sign in or go Pro to see the approach for this follow-up.

QHow does the confused deputy relate to other MCP threats like tool poisoning or rug pulls?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.