MCP server · Tokens
Bearer token only in the Authorization header
The MCP server accepts access tokens only in the Authorization: Bearer header and rejects tokens passed in the query string.
mcp.rs.bearer-header
In revision 2026-07-28
- Level
- MUST
- Defined in
- Authorization › Access Token UsageMCP Authorization 2026-07-28
- Party
- MCP server
- Observable
activeOnly observable by sending requests to the server; recorded by hand or by a future active scanner, never by this site.
Level by revision
| Revision | Level | Section |
|---|---|---|
| 2026-07-28current | MUST | Authorization › Access Token Usage |
| 2025-11-25 | MUST | Access Token Usage › Token Requirements |
Adoption across listed servers
- Supported0
- Partial1
- Unsupported0
- Unknown33
- Not applicable5