MCP Server Security for Ecommerce: OAuth 2.1, Token Scopes, and Stopping Rogue Agents
Every ecommerce store that exposes an MCP server to AI shopping agents is also exposing a potential attack surface. The Model Context Protocol specification, updated to version 2025-06-18 in June 2025, now mandates OAuth 2.1 authorization with scoped access tokens for any HTTP-based MCP server. That means if your store runs an MCP server without proper authentication, you are not just non-compliant with the spec. You are letting any AI agent that discovers your endpoint query your product catalog, read inventory levels, and potentially initiate checkout flows with no identity verification. ...








