Reference security schemes and scopes correctly

Security requirements refer to named schemes, and scopes have meaning only for OAuth 2.0 or OpenID Connect schemes. Correct missing references or repeated scopes. An uncatalogued scope can produce a warning where the scheme declares a static scope catalogue.

Requirement

Security requirements name declared schemes, list scopes only for OAuth 2.0 and OpenID Connect schemes, do not repeat scopes, and use catalogued scopes when the scheme declares a static catalogue.

Details

Rule ID: mcpdesc.security.requirements
Owner: mcpdesc
Surface: Security Requirement
Kind: mcpdesc-semantic
Requirement level: must
Protocol versions: independent of the MCP protocol version
Document schema locations: #/$defs/securityRequirementArray, #/$defs/securityRequirement
Status: internal · Enforcement: internal

Required by

• MCP Description 0.9.0, Sections 7.1 to 7.3
  • 7. Security: req-security-scheme-references
  • 7. Security: req-security-scopes-unique
  • 7. Security: req-security-scopes-oauth-only
  • 7. Security: req-security-uncatalogued-scope
  • 6. Transports: req-transport-security-example
  • 14. Specification Extensions: req-extension-ineligible-locations

Notes

The document schema rejects duplicate scopes first; the semantic duplicate-scope check applies only to direct callers of the semantic validator.

Examples

Accepted with a warning

Source: expected-warning/uncatalogued-oauth-scope.json · Selected: /tools/0/security/0/oauth

[
  "issues:admin"
]

Accepted with a warning

Source: expected-warning/uncatalogued-openid-scope.json · Selected: /security/0/oidc

[
  "profile:read"
]

Invalid example

Source: expected-invalid/unknown-security-reference.json · Selected: /security/0

{
  "missing": []
}

Invalid example

Source: expected-invalid/non-oauth-scopes.json · Selected: /security/0

{
  "bearer": [
    "admin"
  ]
}

Invalid example

Source: expected-invalid/duplicate-security-scope.json · Selected: /security/0

{
  "oauth": [
    "records:read",
    "records:read"
  ]
}

Rule Source Code

document.yaml at immutable tag v0.9.0-rc.3.