Many vendors stop at OAuth for MCP: metadata, consent, and a bearer token. That proves a client got scopes; it does not prove a specific tool should run, that the caller is a verified agent, or that you can audit and revoke machine access like human sessions.
Authdog’s MCP Auth platform keeps OAuth 2.1 and RFC 9728 as the front door, then adds the controls operators expect in production.
Comparison
| Capability | OAuth-only MCP connect | Authdog MCP Auth platform |
|---|---|---|
| Protected-resource metadata (RFC 9728) | Yes | Yes — per environment issuer |
| PKCE authorize + token | Yes | Yes — hosted consent, DCR/CIMD options |
| Scope strings on token | Yes | Yes — catalog + admin-only consent flags |
| Per-tool allow/deny after token | No — app must build | Yes — AuthZEN MCP_TOOL policies |
| Verified agent / trust store | No | Yes — Agents + enforce mode |
Runtime audit (MCP_TOOL_DENIED, …) |
Rarely | Yes — @authdog/mcp-sdk telemetry → Audit/SIEM |
| User revoke from Connected Apps | Varies | Yes — consent + token revocation |
| Enterprise SSO on same issuer | Varies | Yes — same environment IdP as hosted auth |
| SCIM deprovision → revoke grants | Varies | Yes — refresh blocked after deactivation |
| Hosted edge gateway | Varies | Optional — {label}.mcp.authdog.com (024) |
| Management MCP for operators | N/A | https://api.authdog.com/mcp (control plane) |
When OAuth alone is enough
Use a minimal OAuth layer if you only need “signed-in user can hit any tool the server exposes” and you trust your server code to enforce everything else. That fits early prototypes and internal tools with no agent fleet.
When you want the full stack
Choose Authdog MCP Auth when:
- Non-human agents call tools and need verification, pinning, and rug-pull hooks.
- Security wants deny with evidence (
MCP_TOOL_DENIEDin audit/SIEM), not silent 403s in logs. - Compliance wants revocation tied to directory lifecycle (SCIM, deactivate user).
- Product teams want scope + policy separation: OAuth for consent, AuthZEN for tools.
Get started
- Create an MCP server project and enable MCP Auth → Settings.
- Integrate
@authdog/mcp-sdkwith trust store + AuthZEN enforce (MCP security). - Forward
mcp_runtimeevents to your SIEM (MCP authentication → Audit & SIEM).