AI Agent Security (Course)
Issuer Binding
Also: expectedIssuer
Recording which authorization server issued a credential and refusing to send it to any other.
In more detail
In OAuth, an MCP server tells the client which authorization server to use. If a saved refresh token or client secret is not tied to the server it was issued by, a malicious MCP server can name its own and the client will hand the credential over. Binding stores the issuer next to the credential and compares it before every use. The MCP TypeScript SDK added this after a high-severity advisory, and some setups also needed an explicit expected issuer configured.