Agent Wranglers

AGT-39Required

Bind every token to one MCP server with resource indicators

An authorization server that issues tokens for MCP servers reads the resource parameter on authorization and token requests. It puts that URL in the token's aud, and refuses a resource it does not serve with invalid_target.

By Agent Wranglers. Updated .

Spec version

MCP 2026-07-28

Review by

2027-04-30

How to do it

MCP clients must send resource with the canonical URL of the MCP server, such as https://mcp.example.com/mcp. A server that ignores it issues tokens with a wide or empty audience, which every other service would accept. Compare the value with your list of MCP servers after lowercasing the scheme and host, and keep the rest exact. Give a token one audience, so a token for one server opens no other. The MCP server then checks that audience, as Accept only tokens issued for your MCP server and never pass them on says.

Examples

JavaScript example

const MCP_SERVERS = new Set(['https://mcp.example.com/mcp']);
const canonical = value => { const url = new URL(value); return `${url.protocol}//${url.host}${url.pathname}`.replace(/\/$/, ''); };

export function audienceFor(resource) {
  const audience = resource && canonical(resource);
  return MCP_SERVERS.has(audience) ? audience : { error: 'invalid_target' };
}

Python example

from urllib.parse import urlsplit

MCP_SERVERS = {"https://mcp.example.com/mcp"}

def audience_for(resource: str | None) -> str | dict:
    if not resource:
        return {"error": "invalid_target"}
    parts = urlsplit(resource)
    audience = f"{parts.scheme.lower()}://{parts.netloc.lower()}{parts.path}".rstrip("/")
    return audience if audience in MCP_SERVERS else {"error": "invalid_target"}

How to check

A token request with resource=https://mcp.example.com/mcp returns a token whose aud is exactly that URL. A request with resource=https://evil.example.net gets invalid_target and no token.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/resource-indicators">Agent Wranglers agents as users playbook</a>. In code you write, add a comment next to it with the same link.