MCP Agent Identity: One Spec Shipped, Three Still Open

The Model Context Protocol (MCP) roadmap published on August 22 highlights four key workstreams, with agent identity and enterprise-ready security as a priority. So far, only one of these four has been shipped, authenticating human employees rather than agents. This raises a gap between the roadmap and what has been delivered, requiring additional implementation for agents in production.

The two shipped MCP auth extensions consist of a stable specification and a draft. The stable extension, io.modelcontextprotocol/enterprise-managed-authorization, enables organizations to manage access policies for all employees, eliminating the need for each employee to authorize each MCP server individually. The flow involves a browser redirect, user login, ID token issuance, and exchange for an Identity Assertion JWT Authorization Grant (ID-JAG).

The client then presents the ID-JAG to the MCP authorization server, receiving an access token. The ID-P evaluates group membership and conditional access policies at the exchange step, allowing grants and revocations from a single admin console.

However, the client credentials draft, which caters to machine-to-machine scenarios, still requires pre-registered client credentials, typically established through administrative channels. Dynamic Client Registration is not used. This design necessitates pre-registered and out-of-band credential storage, leading to potential security risks if the secret is compromised.

The draft recommends using JWT client authentication over shared secrets, which is a notable improvement. Nevertheless, both the DPoP and Workload Identity Federation proposals, which would provide an agent's own identity, remain open. Both were opened on December 5, 2025, and are still under active revision, with no tests in real applications.