AI Tools
MCP Is Easy to Build. The Spec Sets the Rules First.
An MCP server that uses authorization must check that tokens were issued for it, must never pass tokens through, must sanitize tool outputs, and must implement per-client consent if it proxies a third-party API. The spec does not require human approval for every tool call. It asks clients to prompt for confirmation on sensitive operations.