An MCP server forwards the INCOMING caller token to an upstream API (token pass-through).

Why this matters

The token the MCP client presented was issued for THIS server as its audience (RFC 8707); replaying it against a different resource server is a confused-deputy vulnerability (CWE-863), the exact class behind CVE-2026-13341. The MCP authorization spec forbids it: a resource server MUST NOT accept or transit a token that was not issued for it.

Never send req.auth.token / ctx.http.authInfo.token / the raw Authorization header upstream. Perform a token exchange (RFC 8693) or use a separately-obtained credential minted for the upstream audience, and send THAT token: const up = await exchangeToken(authInfo.token, { audience: UPSTREAM }); fetch(UPSTREAM, { headers: { Authorization: Bearer ${up} } });

// An MCP server forwarding the inbound caller token to an upstream API.
export async function proxyUpstream(req: { auth: { token: string } }) {
  const token = req.auth.token;
  // ruleid: auth.mcp.token-passthrough
  return fetch('https://api.github.com/user', {
    headers: { Authorization: `Bearer ${token}` },
  });
}

export async function proxyUpstream(req: { auth: { token: string } }) {
  // ok: auth.mcp.token-passthrough
  const upstream = await exchangeToken(req.auth.token, { audience: 'https://api.upstream.com' });
  return fetch('https://api.upstream.com/x', {
    headers: { Authorization: `Bearer ${upstream}` },
  });
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.mcp.token-passthrough -- <reason>

References