---
schema_version: "newruntime-agent-readable-v0.2"
type: "post"
stable_id: "post:mcp-oauth-authorization-boundary"
slug: "mcp-oauth-authorization-boundary"
title: "MCP and OAuth Put Agent Authorization on the Critical Path"
description: "PropelAuth's MCP and OAuth 2.1 deep dive shows that agent protocols need explicit user, client, server, and scope boundaries."
retrieval_nugget: "PropelAuth's MCP and OAuth 2.1 deep dive shows that agent protocols need explicit user, client, server, and scope boundaries. The PropelAuth deep dive is a reminder that MCP cannot stay at the level of convenient tool calls. Once an agent can reach real user data or production systems, the protocol needs a clear authorization story: who is the user, who."
status: "published"
published_at: "2026-07-29"
updated_at: "2026-07-29"
record_date: "2026-07-29"
date_kind: "published_at"
topics: ["agent-protocols","ai-security"]
source_urls: ["https://www.propelauth.com/post/oauth-2-1-and-mcp-deep-dive"]
visuals: [{"id":"mcp-oauth-authorization-boundary","kind":"editorial-diagram","role":"hero","src":"https://newruntime.com/images/posts/mcp-oauth-authorization-boundary.webp","alt":"Hand-drawn authorization boundary from user intent and agent client through token scopes and consent into a protected resource.","caption":"MCP tool calls become infrastructure only when identity, token, scopes, consent, logs, and revocation are explicit boundaries.","credit":"New Runtime synthesis","source_url":"https://www.propelauth.com/post/oauth-2-1-and-mcp-deep-dive","generated_with":"nano-banana-style-imagegen","width":1600,"height":900,"legend":[]}]
routes: {"html":"https://newruntime.com/posts/mcp-oauth-authorization-boundary/","markdown":"https://newruntime.com/posts/mcp-oauth-authorization-boundary.md","json":"https://newruntime.com/posts/mcp-oauth-authorization-boundary.json"}
source_format: "markdown"
---

# MCP and OAuth Put Agent Authorization on the Critical Path

## Retrieval answer

PropelAuth's MCP and OAuth 2.1 deep dive shows that agent protocols need explicit user, client, server, and scope boundaries. The PropelAuth deep dive is a reminder that MCP cannot stay at the level of convenient tool calls. Once an agent can reach real user data or production systems, the protocol needs a clear authorization story: who is the user, who.

The PropelAuth deep dive is a reminder that MCP cannot stay at the level of convenient tool calls. Once an agent can reach real user data or production systems, the protocol needs a clear authorization story: who is the user, who is the client, what is the server allowed to do, and which resource scopes are in play.

That matters because agent workflows blur boundaries. A human asks a client to use a server to call another service, often with context that looks like intent rather than a traditional UI action. OAuth gives the ecosystem a vocabulary for consent, delegation, token handling, and revocation, but the details have to fit agent behavior.

The security question is not abstract. If MCP servers become the connective tissue between agents and SaaS systems, then authorization bugs become workflow bugs. The wrong token, scope, or tenant boundary can turn a helpful tool into an unsafe bridge.

For New Runtime, this is another sign that agent protocols are becoming infrastructure. The winning protocol surface is not just extensible. It is auditable, bounded, and understandable when something goes wrong.

## Source

- [OAuth 2.1 and MCP deep dive](https://www.propelauth.com/post/oauth-2-1-and-mcp-deep-dive)