Why did the MCP spec mark OAuth 2.1 authorization as optional, and what risk does this create?

MCP servers run in two very different places. A **stdio server** is a child process the host spawns on your own machine. It has no network port, so the only thing that can reach it is the host that launched it. Asking that server to run a full login flow would add friction for zero security benefit. A remote server is different. It listens on a public URL over HTTP, so anyone on the internet who learns that address can send it requests. That server needs authentication. The spec marked OAuth 2.1 optional so the simple local case stays simple. The unintended consequence is that some developers building remote servers also read "optional" and skipped it. The result was unauthenticated MCP endpoints sitting on the public internet. The correct rule today: stdio servers inherit the host's own credentials, while remote servers must require OAuth so each request carries a scoped per-user token.

The spec split authorization by transport, and that is the key to the answer. **Local stdio servers** run as a child process the host spawns directly. They have no listening socket. Nothing but the host can talk to them. So they reuse the host's own environment and credentials, and OAuth would only add setup friction. Marking it optional was correct for this case. Remote servers are the opposite. A Streamable HTTP server has a public URL. Any client that reaches that URL can call it. These servers do need authentication. The spec defines an OAuth 2.1 flow for exactly this. The server publishes authorization server metadata. The host runs an authorization code grant with PKCE. Resource indicators bind the issued token to one specific server. The risk is a documentation trap. "Optional" was meant to cover the safe local case. Many developers building remote servers read it as blanket permission to skip auth. The consequence was a wave of unauthenticated HTTP endpoints, reachable by anyone who guessed or scraped the URL. The fix is to treat OAuth as mandatory the moment a server is network-reachable.