Dear OAuth WG, I would like to request feedback on an individual Internet-Draft that proposes a framework for service discovery, authentication, and authorization for MCP (Model Context Protocol) Agents, using W3C Decentralized Identifiers (DIDs) and Verifiable Credentials (VCs).
The draft describes how MCP Clients and Servers can use did:web and did:key to establish mutual trust, discover service endpoints, and obtain fine-grained authorization. It defines DID Document extensions for MCP endpoint and directory discovery, a challenge-response authentication protocol, and integration with OAuth 2.0. The goal is to support open, multi-agent MCP deployments without requiring centralized client registration or shared secrets. Why this is relevant to OAuth: The draft proposes to use DIDs and VCs in combination with OAuth 2.0, specifically: * Using DID-based client_assertion JWTs for client authentication, replacing client_secret; * Embedding VCs into access tokens (JWT) to allow local validation by resource servers and reduce introspection calls; * Preserving fallback compatibility with existing OAuth 2.0 clients. Questions for this group: * Does the proposed use of DID-based client assertions introduce any security or interoperability concerns that the draft should address? * Are there existing OAuth extensions or best practices that overlap with the proposed VC-in-token approach? The draft is informational and intended to gather early feedback before determining whether any parts could be developed as formal extensions. Any comments and suggestions are appreciated. Best regards, Xiaohu 发件人: [email protected] <[email protected]> 日期: 星期六, 2026年8月15日 23:37 收件人: Xiaohu Xu <[email protected]> 主题: New Version Notification for draft-xu-mcp-agent-did-framework-00.txt A new version of Internet-Draft draft-xu-mcp-agent-did-framework-00.txt has been successfully submitted by Xiaohu Xu and posted to the IETF repository. Name: draft-xu-mcp-agent-did-framework Revision: 00 Title: DID-Based Service Discovery, Authentication, and Authorization Framework for MCP Agents Date: 2026-08-15 Group: Individual Submission Pages: 22 URL: https://www.ietf.org/archive/id/draft-xu-mcp-agent-did-framework-00.txt Status: https://datatracker.ietf.org/doc/draft-xu-mcp-agent-did-framework/ HTMLized: https://datatracker.ietf.org/doc/html/draft-xu-mcp-agent-did-framework Abstract: This document proposes a DID-based framework for service discovery, authentication, and authorization of MCP (Model Context Protocol) Agents, based on the W3C Decentralized Identifier (DID) standard. The framework uses the did:web and did:key methods to provide verifiable, decentralized identifiers for MCP Clients and Servers. It defines DID method selection, DID Document extensions, service discovery mechanisms (including URL derivation, DNS-based discovery, and directory-based capability queries), and a challenge-response mutual authentication protocol. The framework also describes coexistence with OAuth 2.0 and enables trust establishment, dynamic capability-based service discovery, and fine-grained authorization with portable identities. The IETF Secretariat
_______________________________________________ OAuth mailing list -- [email protected] To unsubscribe send an email to [email protected]
