“Attackers might construct a malicious authorization server and issue a fake access token for the MCP Server. If developers directly extract the issuer... and rely on this malicious authorization server to validate this access token, then this validation will pass.”

That bit stood out. It’s something a lot of people overlook, especially when you’re just trying to get auth working and move on. I’ve worked on teams where we trusted whatever was in the token without checking if the issuer was even allowed.

Makes me think... maybe token validation should be less DIY. Would be nice if libraries made the right thing harder to screw up. Anyone actually using MCP in production yet?