---
title: "Discussion on \"MCP OAuth metadata is not a tool-call permission\" | Hashnode"
description: "Discussion on \"MCP OAuth metadata is not a tool-call permission\". On 29 September 2026, The Hacker News covered a high-severity issue in the official Model Context Protocol Python SDK: a malicious MCP server could trick an affected client into handing over OAuth cre"
url: "https://hashnode.com/posts/mcp-oauth-metadata-is-not-a-tool-call-permission/6abb77eb9cded2c9039d048b"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [MCP OAuth metadata is not a tool-call permission](https://affixio.hashnode.dev/mcp-oauth-metadata-is-not-a-tool-call-permission?utm_source=hashnode&utm_medium=feed)

On 29 September 2026, The Hacker News covered a high-severity issue in the official Model Context Protocol Python SDK: a malicious MCP server could trick an affected client into handing over OAuth cre

Sep 29 · 5 min read · affixio.hashnode.dev  
Read the article

## Written by

[AffixIO](https://hashnode.com/@affixio)

@affixio · United Kingdom

  
[View profile](https://hashnode.com/@affixio)

Verification infrastructure for agents and APIs

## Responses

Markdown supported · ⌘↵ to post

No responses yet.