As AI agent ecosystems mature, a hazardous architectural pattern has emerged: token passthrough. Because agents often require permissions across third-party services, some server implementations attempt to accept raw OAuth tokens from the client and forward them blindly to downstream backends.
Why is this dangerous? First, ambient authority. If an agent is compromised via prompt injection, an attacker can leverage downstream credentials with excessive privileges. Second, lack of auditability. When the server acts as an opaque proxy, attribution is lost.
Instead, implement the Principle of Bounded Scope. The MCP server should authenticate the calling agent through signed session keys, perform its own authorization check against an explicit capability list, and use tightly scoped, short-lived service tokens for downstream requests.
Telemetry should always redact authorization headers, bearer tokens, and session identifiers at the client boundary before emitting events to your observability platform.