MCP Token Passthrough / Audience Confusion (Confused Deputy)

mcp-token-audience-confusion is a high severity check in the ai category, written in python. Its source is templates/ai/mcp/mcp-token-audience-confusion.py in cert-x-gen-templates.

What it checks

ACTIVE check. Detects an MCP server that authenticates requests yet accepts a Bearer token whose audience (aud) is not scoped for it - the token passthrough / confused-deputy anti-pattern the June 2025 MCP spec explicitly forbids

Header

Field	Value
Id	mcp-token-audience-confusion
Severity	high
Language	python
Category	ai
Author	Bugb Research
Template version	1.0.0
Confidence	90
CVSS	8.1
Weakness	CWE-287, CWE-441
Tags	mcp, ai, agent, broken-auth, token-passthrough, audience-confusion, confused-deputy, oauth, intrusive, active, cwe-287, cwe-441
Target kind	http
Oracle	property

Conventions of the repository, not fields the engine reads

@target_kinds and @oracles are documented in the templates repository’s contribution guide, and cxg’s annotation parser does not carry them into a template’s metadata. Nothing at scan time selects on them. The annotation header schema is every field the parser does read.

References

Declared in the header. cxg parses @references and then discards it, and nothing at scan time reads it, so this is the only place the links a template cites are surfaced.

• https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization
• https://modelcontextprotocol.io/specification/2025-06-18/basic/security_best_practices
• https://www.rfc-editor.org/rfc/rfc8707.html
• https://www.rfc-editor.org/rfc/rfc8693.html
• https://www.descope.com/blog/post/mcp-auth-spec
• https://www.practical-devsecops.com/glossary/token-passthrough-vulnerability/
• https://cwe.mitre.org/data/definitions/441.html

Run it

To see what the copy on your machine says about itself, and to confirm it is installed at all:

cxg template info mcp-token-audience-confusion

The id it prints is the one to pass anywhere a template is selected. See cxg template for the rest of the subcommand, Scan a target for running a scan, and A match is not a finding for how to read what comes back.

Related

• Template catalog is the whole corpus.
• ai is the rest of this category.
• Templates by weakness class groups checks by the defect they look for.
• Contribute a template is the route from a check you needed and could not find to a merged one.