40% of MCP servers have no authentication — how LIME fixes this

Why MCP authentication is still hard

The specification provides the right primitives. In practice, developers still face low-level implementation burden:

• discovery/metadata, issuer and keys;
• correct JWT signature verification;
• audience, token lifetime and clock skew;
• JWKS caching, key rotation and network-error fallback.

With the official MCP Python SDK, teams often implement substantial auth plumbing manually. It is flexible, but expensive in time and quality, especially when shipping fast.

As MCP adoption grows, this creates common anti-patterns: static keys, broad permissions and incomplete token validation.

What MCP v2 changes on July 27, 2026 — and what it does not

MCP v2 is a major ecosystem update, but it does not solve security automatically: you still need a production-ready MCP authentication model with verifiable agent identity and short-lived tokens.

Solution: LIME as an MCP OAuth provider for AI agents

LIME is an identity layer for AI agents:

• cryptographic passport for AI agents (signed JWT);
• verification via JWKS;
• an MCP OAuth provider that issues short-lived tokens.

Key point: LIME does not only issue OAuth tokens. It first issues an agent passport. The flow X-Agent-Token -> JWT takes one step and creates cryptographically verifiable agent identity.

1. The agent authenticates to LIME with X-Agent-Token.
2. It receives a signed JWT passport (agent identity).
3. For MCP it receives an OAuth access token (aud=mcp) on top of that identity model.
4. The MCP resource server validates the token via JWKS and standard JWT claims.

LIME also exposes OAuth metadata in RFC 8414 format, including issuer, token_endpoint and jwks_uri.

curl -sS https://lime.pics/.well-known/oauth-authorization-server | jq .

This enables straightforward client auto-configuration and transparent verification of OAuth parameters.

How to add OAuth to an MCP server without building everything from scratch

Here is the minimal implementation path.

Call MCP from the agent with lime-agents-sdk

import asyncio
import os

from lime_agents import LimeAgent

MCP_URL = "https://your-mcp-server.example/mcp"
agent = LimeAgent(agent_token=os.environ["LIME_AGENT_TOKEN"])


async def main() -> None:
    try:
        tools = await agent.list_tools(MCP_URL)  # SDK fetches MCP OAuth token automatically
        print(f"tools: {len(tools)}")
    finally:
        await agent.aclose()


asyncio.run(main())

Validate Bearer tokens on MCP server with lime-mcp-server-sdk

from lime_mcp_server import TokenVerifier

verifier = TokenVerifier(
    expected_domain="your-mcp-rs.example",
    base_url="https://lime.pics",
    audience="mcp",
)


async def verify_access_token(token: str) -> str:
    result = await verifier.verify_async(token)
    if not result.is_valid:
        raise PermissionError(result.error or "invalid_token")
    return result.agent_id or result.claims.get("sub", "")

• RS256 signature validation against current JWKS;
• one consistent iss/aud/exp verification path;
• fewer security edge-case mistakes.

Approach comparison: manual OAuth vs providers vs LIME

LIME is not the only possible solution. But for teams that need a fast and verifiable MCP authentication path without building an OAuth server from scratch, it is one of the shortest routes to production.

Why this matters now

• Nearly half of public MCP endpoints have no auth (40.55%).
• MCP v2 accelerates adoption but does not remove security responsibility.
• Agent identity is becoming a core architectural category.

If your server is already in MCP catalogs, the question is no longer whether to add authentication, but how to ship it without delaying release cycles.

Practical checklist: how to secure MCP server

1. Use short-lived Bearer tokens instead of static keys.
2. Validate iss, aud, exp and signature on every request.
3. Use a safe JWKS cache policy with refresh and fallback.
4. Log sub (agent identity) and jti for incident analysis.
5. Separate machine-to-machine auth from user sessions.

What to read next

• Home: https://lime.pics
• Registration: https://lime.pics/register/
• Docs: https://lime.pics/docs
• GitHub: lime-agents-sdk
• GitHub: lime-site-sdk
• GitHub: lime-mcp-server-sdk