Skip to content
MCP Stateless Check

MCP019 — Authorization server does not advertise RFC 9207 iss support
Severity warning
Fixed by A change in your own server code
Transports http
Specification 2026-07-28
Changelog entry Minor change 7 (SEP-2468)

Why this changed

SEP-2468 brought RFC 9207 into MCP: an authorization server SHOULD return iss in its authorization responses, and advertise that it does with authorization_response_iss_parameter_supported. Without it a client talking to more than one authorization server cannot tell which one a response came from — the opening a mix-up attack needs — and the spec’s own validation table leaves such a client nothing to check.

This inspects published metadata only. It never starts an authorization flow, and never sends the user’s headers to the hosts the metadata names.

Running just this check

Terminal window
npx mcp-stateless --http https://mcp.example.com/mcp --only MCP019

Suppressing it

If this check does not apply to your server, skip it:

Terminal window
npx mcp-stateless --http https://mcp.example.com/mcp --skip MCP019

Rule ids are permanent and are never reissued, so a suppression cannot start silently matching a different check later.

Generated from src/rules/MCP019.ts by scripts/gen-rule-docs.mjs. Edit the rule source, not this page.