MCP Authorization Extensions

The Model Context Protocol (MCP) specification is defined in the main specification repository. This repository contains extensions to the core protocol that define additional authorization mechanisms.

These extensions are:

• Optional - Implementations can choose to adopt these extensions
• Additive - Extensions do not modify or break core protocol functionality; they add new capabilities while preserving core protocol behavior
• Composable - Extensions are modular and designed to work together without conflicts, allowing implementations to adopt multiple extensions simultaneously
• Versioned independently - Extensions follow the core MCP versioning cycle but may adopt independent versioning as needed

Extensions

• Client Credentials
• Enterprise-Managed Authorization

Governance

This repository follows the Model Context Protocol Governance process, with a dedicated set of maintainers for authorization extensions. See MAINTAINERS.md for the list of maintainers specific to this repository.

All decisions regarding authorization extensions follow the same governance model as the core specification, including:

• Specification Enhancement Proposals (SEPs)
• Community discussion and consensus building
• Maintainer review and approval
• Transparent decision-making

Policies

This repository follows the Model Context Protocol project policies:

• Code of Conduct
• Contributing Guidelines
• Security Policy
• Antitrust Policy