The Model Context Protocol (MCP) specification is defined in the main specification repository. This repository contains extensions to the core protocol that define additional authorization mechanisms.

These extensions are:

• Optional - Implementations can choose to adopt these extensions
• Additive - Extensions do not modify or break core protocol functionality; they add new capabilities while preserving core protocol behavior
• Composable - Extensions are modular and designed to work together without conflicts, allowing implementations to adopt multiple extensions simultaneously
• Versioned with the core protocol - A Stable extension is published as revisions keyed to core protocol revisions, and proposed changes collect in its draft/ directory

The directory that holds an extension's specification shows its stage: specification/experimental/, specification/beta/ or specification/stable/. SEP-3392 defines the stages.

• Enterprise-Managed Authorization (draft)
• OAuth Client Credentials (draft)

This repository follows the Model Context Protocol Governance process, with a dedicated set of Extension Maintainers for authorization extensions, listed in MAINTAINERS.md. The extensions are associated with the Authorization Interest Group.

All decisions regarding authorization extensions follow the same governance model as the core specification, including:

• Specification Enhancement Proposals (SEPs)
• Community discussion and consensus building
• Maintainer review and approval
• Transparent decision-making

This repository follows the Model Context Protocol project policies:

• Code of Conduct
• Contributing Guidelines
• Security Policy
• Antitrust Policy