--- title: The Complicating Factors of Deploying MCP in the Enterprise description: Deploying MCP in enterprise environments hits real friction around authentication and authorization, according to a Field CTO at Teleport reacting to... canonical: https://daily.dev/posts/the-complicating-factors-of-deploying-mcp-in-the-enterprise-t3ukhnt3p twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: The Complicating Factors of Deploying MCP in the Enterprise | daily.dev og:description: Deploying MCP in enterprise environments hits real friction around authentication and authorization, according to a Field CTO at Teleport reacting to... og:url: https://daily.dev/posts/the-complicating-factors-of-deploying-mcp-in-the-enterprise-t3ukhnt3p og:image: https://api.daily.dev/og/posts/T3UkhNt3p.png og:image:alt: The Complicating Factors of Deploying MCP in the Enterprise og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # The Complicating Factors of Deploying MCP in the Enterprise **[Teleport](https://daily.dev/sources/teleport)** · 10 min read · 0 upvotes · 0 comments ## Summary Deploying MCP in enterprise environments hits real friction around authentication and authorization, according to a Field CTO at Teleport reacting to Doyensec's recent security analysis of MCP's AuthN/Z architecture. MCP launched with no auth mechanism and has gone through five spec versions in roughly 13 months, most recently adding OAuth 2.1 separation, client registration, and mandatory PKCE in the November 2025 release. Structural issues remain: OAuth assumes human consent decisions, but MCP has LLMs autonomously choosing scopes at runtime. The Enterprise-Managed Authorization Extension (JAG) has four unresolved problems: no token revocation, LLM scope abuse, scope namespace collisions across IdPs, and ID-JAG replay amplification. The core spec still lacks mTLS/certificate auth, per-tool authorization, audit trail specs, and gateway behavior specs, pushing enterprise security into extensions rather than the base protocol. Teleport's approach bypasses OAuth entirely, using a protocol-level proxy with short-lived X.509 certificates and a two-tier RBAC model (server-level and per-tool access control) to enforce deny-by-default policies and structured audit logging. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What authentication mechanism does the current MCP spec use as of the November 2025 version? The November 2025 MCP spec version, the current stable release, introduced a new client registration mechanism, enterprise extensions, and mandatory PKCE on top of OAuth 2.1. Earlier versions had issues: the initial March 2025 OAuth 2.1 addition made the MCP server act as both resource server and authorization server, which the June 2025 version later fixed by separating those roles. _Track how MCP's authentication model keeps evolving before wiring agents into production on daily.dev._ ### Why is OAuth considered a bad fit for securing MCP in enterprise AI deployments? OAuth was designed for a human user who reads a consent screen and evaluates requested scopes, but MCP in enterprise contexts has a non-deterministic LLM deciding which scopes it needs at runtime instead. This mismatch is structural, not an implementation bug, and the Enterprise-Managed Authorization Extension (JAG) still has open problems including no token invalidation, scope abuse, IdP namespace collisions, and replay amplification via ID-JAG tokens. _Developers weighing agent authorization patterns can follow how MCP security gaps get resolved on daily.dev._ ### What security capabilities are missing from the core MCP protocol specification? The core MCP spec lacks mTLS or certificate-based authentication, per-tool authorization within a server, an audit trail specification, and gateway behavior guidance, leaving these to extensions instead. As a result, OAuth scopes only authorize connection to an MCP server, not individual tools, so any connected client can call all of a server's exposed tools, which is too coarse for enterprises running servers with 20+ tools. _Teams building MCP gateways can keep up with these unresolved spec gaps via daily.dev before shipping to production._ ## Similar posts on daily.dev - [MCP gets its missing enterprise authorization layer](https://daily.dev/posts/mcp-gets-its-missing-enterprise-authorization-layer-9gkkeg9th) · The New Stack · 1 upvotes · 0 comments - [What Tech Leaders Need to Know About MCP Authentication in 2025](https://daily.dev/posts/what-tech-leaders-need-to-know-about-mcp-authentication-in-2025-xi92itnas) · Security Boulevard · 1 upvotes · 0 comments - [The MCP debate has a context problem](https://daily.dev/posts/the-mcp-debate-has-a-context-problem-0pzz9axsf) · The New Stack · 0 upvotes · 0 comments --- Tags: [#authentication](https://daily.dev/tags/authentication), [#mcp](https://daily.dev/tags/mcp), [#oauth](https://daily.dev/tags/oauth) [View this post on daily.dev](https://daily.dev/posts/the-complicating-factors-of-deploying-mcp-in-the-enterprise-t3ukhnt3p) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"The Complicating Factors of Deploying MCP in the Enterprise","url":"https://daily.dev/posts/the-complicating-factors-of-deploying-mcp-in-the-enterprise-t3ukhnt3p","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/the-complicating-factors-of-deploying-mcp-in-the-enterprise-t3ukhnt3p"},"datePublished":"2026-08-23T12:19:22.852Z","dateModified":"2026-08-23T12:31:32.238Z","description":"Deploying MCP in enterprise environments hits real friction around authentication and authorization, according to a Field CTO at Teleport reacting to...","image":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","thumbnailUrl":"https://media.daily.dev/image/upload/s--2-1xRawN--/f_auto/v1722860399/public/Placeholder%2011","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/the-complicating-factors-of-deploying-mcp-in-the-enterprise-t3ukhnt3p","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"authentication,mcp,oauth","timeRequired":"PT10M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"The Complicating Factors of Deploying MCP in the Enterprise"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/the-complicating-factors-of-deploying-mcp-in-the-enterprise-t3ukhnt3p#faq","mainEntity":[{"@type":"Question","name":"What authentication mechanism does the current MCP spec use as of the November 2025 version?","acceptedAnswer":{"@type":"Answer","text":"The November 2025 MCP spec version, the current stable release, introduced a new client registration mechanism, enterprise extensions, and mandatory PKCE on top of OAuth 2.1. Earlier versions had issues: the initial March 2025 OAuth 2.1 addition made the MCP server act as both resource server and authorization server, which the June 2025 version later fixed by separating those roles. Track how MCP's authentication model keeps evolving before wiring agents into production on daily.dev."}},{"@type":"Question","name":"Why is OAuth considered a bad fit for securing MCP in enterprise AI deployments?","acceptedAnswer":{"@type":"Answer","text":"OAuth was designed for a human user who reads a consent screen and evaluates requested scopes, but MCP in enterprise contexts has a non-deterministic LLM deciding which scopes it needs at runtime instead. This mismatch is structural, not an implementation bug, and the Enterprise-Managed Authorization Extension (JAG) still has open problems including no token invalidation, scope abuse, IdP namespace collisions, and replay amplification via ID-JAG tokens. Developers weighing agent authorization patterns can follow how MCP security gaps get resolved on daily.dev."}},{"@type":"Question","name":"What security capabilities are missing from the core MCP protocol specification?","acceptedAnswer":{"@type":"Answer","text":"The core MCP spec lacks mTLS or certificate-based authentication, per-tool authorization within a server, an audit trail specification, and gateway behavior guidance, leaving these to extensions instead. As a result, OAuth scopes only authorize connection to an MCP server, not individual tools, so any connected client can call all of a server's exposed tools, which is too coarse for enterprises running servers with 20+ tools. Teams building MCP gateways can keep up with these unresolved spec gaps via daily.dev before shipping to production."}}]} ```