Remote MCP OAuth Discovery: Keep Metadata Fetches Out of Internal Networks
Remote MCP authorization can make a client fetch server-supplied metadata URLs. Adoption should constrain every discovery hop, DNS result, redirect, and outbound route before credentials or internal services are exposed.
Read in JapaneseA remote MCP endpoint can influence where its client connects next during OAuth discovery. The official MCP security guidance identifies three such inputs: resource_metadata from WWW-Authenticate, authorization-server URLs in protected-resource metadata, and endpoints in authorization-server metadata. If a server controls one of those values, an otherwise legitimate MCP client can become a path to loopback services, private networks, or a cloud instance-metadata address.
The security boundary is therefore larger than the configured MCP URL. It includes every URL fetched during discovery, every redirect, and the IP address used when the connection is made. Checking that the first URL uses HTTPS or that a hostname looked public once does not constrain the eventual destination.
Review the complete fetch chain
| Stage | Weak acceptance evidence | Useful acceptance evidence |
|---|---|---|
| Initial challenge | MCP endpoint uses HTTPS | resource_metadata is parsed with a standards-based URL parser and passes the outbound policy |
| Metadata expansion | JSON has expected fields | Every authorization-server and endpoint URL is checked independently |
| DNS | Hostname resolved to a public IP during validation | The address used for the connection is checked; DNS changes cannot switch it to a prohibited range |
| Redirect | First response was allowed | Automatic redirects are disabled or every hop is revalidated |
| Network | Application code contains a blocklist | An egress proxy or network policy also denies loopback, link-local, private, and metadata destinations |
For a production server-side client, require HTTPS and deny private, reserved, loopback, and link-local destinations by default. Treat IPv6, IPv4-mapped IPv6, alternate numeric encodings, and redirects consistently. Keep any development exception explicit and scoped to a known loopback endpoint rather than making http or private networks generally reachable.
DNS creates a time-of-check/time-of-use problem. A name may resolve to a public address during validation and an internal address during the actual request. Use a maintained SSRF-safe connector or egress gateway that validates the address actually dialed. Apply the same rule after redirects. Timeouts, response-size limits, and safe error handling reduce scanning and data-return opportunities, but they do not replace destination control.
Verify the deployed client, not only the MCP server
This risk sits in the component performing OAuth discovery. Record which host or gateway fetches metadata, its DNS resolver and proxy path, and the network identities it can reach. In a controlled test, supply metadata that attempts loopback, private IPv4, link-local, private IPv6, and a redirect from a public test host to a denied address. Acceptance means no prohibited connection is attempted and the failure does not return internal response content.
The current MCP protocol version is 2026-07-28; the official versioning page labels it Current and labels /draft material as not ready for consumption. The current authorization security considerations also discuss SSRF when an authorization server fetches a Client ID Metadata Document. That is the same class of outbound-boundary problem on a different actor: confirm which component performs each fetch before assigning the control.
Scope and limits
These controls address HTTP destinations reached through MCP-related OAuth discovery and client metadata retrieval. They do not prove that tool implementations cannot make their own outbound requests, that a permitted public endpoint is trustworthy, or that the authorization flow grants appropriate scopes. An allowlisted destination can still serve malicious metadata; validate the document structure and bind tokens to the intended MCP resource as separate checks.