# MCP: Scope step-up is not authentication step-up

DevFeed: [MCP: Scope step-up is not authentication step-up](<https://devfeed.tech/articles/mcp-scope-step-up-is-not-authentication-step-up-16030.md>)

Original publisher: [Read original article](<https://workos.com/blog/mcp-scope-step-up-vs-authentication-step-up>)

Author: WorkOS

Published: 2026-09-01T00:00:00Z

Content type: article

Language: en

Sources: [WorkOS Blog](<https://devfeed.tech/sources/workos-blog.md>)

Topics: [Model Context Protocol](<https://devfeed.tech/topics/model-context-protocol.md>), [Authentication](<https://devfeed.tech/topics/authentication.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [MCP Server](<https://devfeed.tech/topics/mcp-server.md>)

Tags: [authentication](<https://devfeed.tech/tags/authentication.md>), [authorization](<https://devfeed.tech/tags/authorization.md>), [browser](<https://devfeed.tech/tags/browser.md>), [compliance](<https://devfeed.tech/tags/compliance.md>), [delivery](<https://devfeed.tech/tags/delivery.md>), [mcp](<https://devfeed.tech/tags/mcp.md>), [mcp-server](<https://devfeed.tech/tags/mcp-server.md>), [model-context-protocol](<https://devfeed.tech/tags/model-context-protocol.md>), [permission](<https://devfeed.tech/tags/permission.md>), [protocol](<https://devfeed.tech/tags/protocol.md>), [scope](<https://devfeed.tech/tags/scope.md>), [token](<https://devfeed.tech/tags/token.md>)

## AI overview

The article distinguishes MCP scope step-up from authentication step-up. MCP's current authorization flow addresses insufficient permission by obtaining broader scopes, but it does not standardize verifying whether a human recently authenticated or is still present. It recommends binding out-of-band approval to the user and exact operation until this changes.

## Source excerpt

MCP standardized how an agent asks for more permission. It has no vocabulary yet for asking whether the human behind the token is still there.