Recent updates to the MCP specification have started to address this. OAuth 2.0 flows are now required, and resource server ...