Auth0 just GA'd MCP authentication. Here's the half they left out.

Five days ago, on May 6, Auth0 went GA with Auth for MCP. It's a real production-grade primitive. If your problem is "I run an MCP server and I want to know which agent is calling, with proper OAuth and on-behalf-of tokens," they shipped it. Use it.

But if your problem is "this agent just hit my image_describe tool 50,000 times in an hour and I have no way to charge for it," you're still on your own. Identity is not the same problem as per-call payment, and nobody in the named MCP-auth provider list is solving the second one.

Here's a working endpoint that does.…