When an agent calls tools on behalf of users, two questions matter on every request: who is calling, and what are they allowed to do. Authentication answers the first, with API keys, signed JWTs or OAuth. Authorization answers the second, with roles and scopes checked on each tool, so an agent acting for one user cannot reach another user's data.
Agents increasingly need an identity of their own, presented as short-lived credentials rather than shared secrets. These guides cover adding API keys, JWT and OAuth to MCP servers, building an authenticated server for an agent, giving agents verifiable identities, keeping tenants apart, access control in retrieval systems, and an MCP security checklist.
The library lists all guides with filters for topic, level, category and reading time.