# Security

Canonical URL: https://vercel-mcp-reference.vercel.app/security/
Markdown: https://vercel-mcp-reference.vercel.app/security.md
Audience: security, engineer, architect. MCP spec version: 2026-07-28. Last reviewed: 2026-08-26. Status: stable.

How an MCP server on Vercel authenticates callers, decides who a request acts
for, and avoids the characteristic MCP failure modes: token passthrough and the
confused deputy, identity spoofed through tool arguments, over-broad
credentials, and the deployment traps that are specific to public serverless
URLs (an unprotected preview deployment is a live server). Read the
authorization flow first, then the identity rule, then run the checklist before
you ship. On Vercel every MCP server is a public HTTP endpoint by default, so
the security posture is not an add-on to the deployment model; it is the
deployment model.

## Pages

- [Authorization flows](https://vercel-mcp-reference.vercel.app/security/authorization/) - the MCP server as an OAuth 2.1
  **resource server**: RFC 9728 Protected Resource Metadata discovery, client
  registration (Client ID Metadata Documents first, Dynamic Client
  Registration now deprecated), the Authorization Code + PKCE flow with
  RFC 9207 issuer validation, audience binding as the keystone against
  token replay, and the whole thing wired to `withMcpAuth` and
  `protectedResourceHandler` on Vercel.
- [Where the principal comes from](https://vercel-mcp-reference.vercel.app/security/identity-and-principals/) - derive
  identity from the **verified token**, never from a tool argument; how
  `AuthInfo` flows from `verifyToken` into your tool handlers.
- [MCP server security checklist](https://vercel-mcp-reference.vercel.app/security/checklist/) - a printable pre-deploy
  checklist covering auth, least privilege, input and output handling, and the
  Vercel-specific items (Deployment Protection, protection-bypass secrets,
  env var scoping, Firewall) that other pages deep-link by section.

## Where to look now

- [Least privilege](https://vercel-mcp-reference.vercel.app/patterns/least-privilege/) - the pattern-level
  expression of scoping: per-tool scope declarations and OIDC federation
  instead of static cloud keys.
- [Trust boundaries](https://vercel-mcp-reference.vercel.app/patterns/trust-boundaries/) - where the three
  boundaries fall on Vercel and which platform control holds each one.
- [Credential brokering](https://vercel-mcp-reference.vercel.app/client-side/credential-brokering/) - the
  host-side half: holding secrets and handing servers only narrowly scoped,
  short-lived credentials.
- [Serverless sessions](https://vercel-mcp-reference.vercel.app/internals/serverless-sessions/) - 2026-07-28
  removed protocol sessions outright; per-request authentication and
  server-minted handles are the model, and instance churn is why they
  always were.