Skip to content
vercel-mcp-reference

Community-maintained FDE reference. Not an official Vercel or Anthropic project. About this project

Security

Audience:securityengineerarchitectMCP spec 2026-07-28

How an MCP server on Vercel authenticates callers, decides who a request acts for, and avoids the characteristic MCP failure modes: token passthrough and the confused deputy, identity spoofed through tool arguments, over-broad credentials, and the deployment traps that are specific to public serverless URLs (an unprotected preview deployment is a live server). Read the authorization flow first, then the identity rule, then run the checklist before you ship. On Vercel every MCP server is a public HTTP endpoint by default, so the security posture is not an add-on to the deployment model; it is the deployment model.

Pages

  • Authorization flows - the MCP server as an OAuth 2.1 resource server: RFC 9728 Protected Resource Metadata discovery, client registration (Client ID Metadata Documents first, Dynamic Client Registration now deprecated), the Authorization Code + PKCE flow with RFC 9207 issuer validation, audience binding as the keystone against token replay, and the whole thing wired to withMcpAuth and protectedResourceHandler on Vercel.
  • Where the principal comes from - derive identity from the verified token, never from a tool argument; how AuthInfo flows from verifyToken into your tool handlers.
  • MCP server security checklist - a printable pre-deploy checklist covering auth, least privilege, input and output handling, and the Vercel-specific items (Deployment Protection, protection-bypass secrets, env var scoping, Firewall) that other pages deep-link by section.

Where to look now

  • Least privilege - the pattern-level expression of scoping: per-tool scope declarations and OIDC federation instead of static cloud keys.
  • Trust boundaries - where the three boundaries fall on Vercel and which platform control holds each one.
  • Credential brokering - the host-side half: holding secrets and handing servers only narrowly scoped, short-lived credentials.
  • Serverless sessions - 2026-07-28 removed protocol sessions outright; per-request authentication and server-minted handles are the model, and instance churn is why they always were.

Community-maintained by forward deployed engineers (FDE). This is an independent reference. It is not an official Vercel or Anthropic project and is not affiliated with, endorsed by, or published by either company.

"Vercel" and "Next.js" are trademarks of Vercel, Inc.; "Model Context Protocol" originates from Anthropic. These names are used only to describe compatibility and subject matter.