When your Model Context Protocol (MCP) client connects to a new tool server, it often starts an OAuth handshake before exchanging any tool definitions. To do that without hardcoded credentials, modern MCP implementations rely on dynamic discovery.

Before your client opens a login page, it fetches a small JSON file. That file tells the client which authorisation server to trust, which token endpoints to query and which signing keys to verify. The trouble is that the remote MCP server chooses that URL. If an attacker controls the server, they control where your client sends its next HTTP request.

If the client fetches that URL without strict network controls, an attacker can point it straight at your local machine, your internal Kubernetes network or your cloud metadata service.…