---
title: "Bind every token to one MCP server with · Agent Wranglers"
url: https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/resource-indicators
id: AGT-39
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1038
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Bind every token to one MCP server with resource indicators

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Delegated access and consent](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: AGT-39
- Level: Required
- Chapter: [Delegated access and consent](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent.md)
- Rule: An authorization server that issues tokens for MCP servers reads the `resource` parameter on authorization and token requests. It puts that URL in the token's `aud`, and refuses a resource it does not serve with `invalid_target`.
- Check: A token request with `resource=https://mcp.example.com/mcp` returns a token whose `aud` is exactly that URL. A request with `resource=https://evil.example.net` gets `invalid_target` and no token.
- Risk: An account or system taken over
- Spec version: MCP 2026-07-28
- Review by: 2027-04-30
- How: MCP clients must send `resource` with the canonical URL of the MCP server, such as `https://mcp.example.com/mcp`. A server that ignores it issues tokens with a wide or empty audience, which every other service would accept. Compare the value with your list of MCP servers after lowercasing the scheme and host, and keep the rest exact. Give a token one audience, so a token for one server opens no other. The MCP server then checks that audience, as [Accept only tokens issued for your MCP server and never pass them on](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/mcp-token-audience-no-passthrough.md) says.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const MCP_SERVERS = new Set(['https://mcp.example.com/mcp']);
const canonical = value => { const url = new URL(value); return `${url.protocol}//${url.host}${url.pathname}`.replace(/\/$/, ''); };

export function audienceFor(resource) {
  const audience = resource && canonical(resource);
  return MCP_SERVERS.has(audience) ? audience : { error: 'invalid_target' };
}
```

### Python example

```python
from urllib.parse import urlsplit

MCP_SERVERS = {"https://mcp.example.com/mcp"}

def audience_for(resource: str | None) -> str | dict:
    if not resource:
        return {"error": "invalid_target"}
    parts = urlsplit(resource)
    audience = f"{parts.scheme.lower()}://{parts.netloc.lower()}{parts.path}".rstrip("/")
    return audience if audience in MCP_SERVERS else {"error": "invalid_target"}
```

## Sources

- [RFC 8707 (Resource Indicators for OAuth 2.0)](https://www.rfc-editor.org/rfc/rfc8707)
- [MCP authorization, resource parameter](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization)

## Related rules

- AGT-38 [Accept only tokens issued for your MCP server and never pass them on](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/mcp-token-audience-no-passthrough.md) in Agents as users

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/resource-indicators">Agent Wranglers agents as users playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Accept only tokens issued for your MCP server and never pass them on](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/mcp-token-audience-no-passthrough.md)
- Next: [Require PKCE and exact redirect addresses for MCP clients](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent/pkce-and-exact-redirects.md)
- [Delegated access and consent](https://agentwranglers.se/playbook/agents-as-users/delegated-access-and-consent.md)