An MCP server forwards the INCOMING caller token to an upstream API (token pass-through).

Why this matters

The token was issued for THIS server as its audience (RFC 8707); replaying it against another resource server is a confused-deputy vulnerability (CWE-863). The MCP authorization spec is explicit: a resource server MUST NOT accept or transit a token that was not issued for it.

Never send get_access_token().token / access_token.token / the raw Authorization header upstream. Do a token exchange (RFC 8693) or use a credential minted for the upstream audience, and send THAT token: upstream = await exchange_token(access_token.token, audience=UPSTREAM) await client.get(UPSTREAM, headers={"Authorization": f"Bearer {upstream}"})

async def call_upstream(access_token, client):
    # ruleid: auth.py.mcp.token-passthrough
    return await client.get(
        "https://api.github.com/user",
        headers={"Authorization": f"Bearer {access_token.token}"},
    )

async def call_upstream(access_token, client):
    # ok: auth.py.mcp.token-passthrough
    upstream = await exchange_token(access_token.token, audience="https://api.upstream.com")
    return await client.get(
        "https://api.upstream.com/x",
        headers={"Authorization": f"Bearer {upstream}"},
    )

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

# oauthlint-disable-next-line auth.py.mcp.token-passthrough -- <reason>

References