Authorization is formally optional in MCP. That wording misleads people. It means you may run an unprotected server; it does not mean you get to half-implement a protected one.

Source: [Dev.to](https://dev.to/guybrushulyssesthreepwood/oauth-21-for-mcp-servers-done-properly-41le)

Sponsored