The MCP spec does not require or define token revocation. The MCP authorization spec (2026-07-28) covers discovery, the authorization flow and token handling, and it leaves "the implementation details of the authorization server" out of scope. Revocation is standard OAuth: the OAuth standard for it is RFC 7009, and whether your authorization server supports it depends on that server. What MCP does require is the server side of the check: "Invalid or expired tokens MUST receive a HTTP 401 response." Revoke at the authorization server, and make sure your MCP server rejects the token once it's revoked.
Who does what
| Piece | Responsibility | Source |
|---|---|---|
| Authorization server | Accepts revocation requests and invalidates tokens, if it supports RFC 7009 | RFC 7009 |
| MCP server | Validates every token, including audience, and returns `401` for invalid or expired tokens | MCP Authorization 2026-07-28 |
| MCP client | Sends only tokens issued by the MCP server's authorization server | MCP Authorization 2026-07-28 |
Whether a given client calls a revocation endpoint when a user disconnects is up to that client. Check its docs rather than assuming it does.
The revocation request (RFC 7009 §2.1)
The client POSTs the `token`, with an optional `token_type_hint` of `access_token` or `refresh_token`, to the authorization server's revocation endpoint, form-encoded, with its client credentials. RFC 7009's own example:
POST /revoke HTTP/1.1
Host: server.example.com
Content-Type: application/x-www-form-urlencoded
Authorization: Basic czZCaGRSa3F0MzpnWDFmQmF0M2JWtoken=45ghiukldjahdnhzdauz&token_type_hint=refresh_token ```
On related tokens, RFC 7009 §2.1 says, verbatim:
> "Depending on the authorization server's revocation policy, the revocation of a particular token may cause the revocation of related tokens and the underlying authorization grant. If the particular token is a refresh token and the authorization server supports the revocation of access tokens, then the authorization server SHOULD also invalidate all access tokens based on the same authorization grant (see Implementation Note). If the token passed to the request is an access token, the server MAY revoke the respective refresh token as well."
It also notes that "there could be a propagation delay, for example, in which some servers know about the invalidation while others do not."
What your MCP server has to do
- Validate every request's token. The spec says MCP servers "MUST validate access tokens" and "MUST validate that access tokens were issued specifically for them as the intended audience." See token audience and resource mismatch.
- Return `401` once a token is no longer valid. That's the signal for the client to re-authorize. Refresh token expired: reconnect covers the client side of that loop.
- Know how your server learns about revocation. If it validates self-contained tokens locally, a revoked token can keep passing until it expires. Check your authorization server's token lifetime and introspection options.
Pitfalls
- Assuming MCP handles disconnect. It doesn't define revocation; plan it with your authorization server.
- Revoking only the access token. Under RFC 7009 the server MAY revoke the refresh token too, but it isn't required to.
- Long-lived self-contained access tokens. Revocation at the AS may not reach a resource server that never checks back.
- Returning `403` for a revoked token. The spec reserves `403` for insufficient scope; invalid or expired tokens get `401`.
How to check it
Connect a client, revoke its refresh token at your authorization server, then make another tool call. Confirm your MCP server returns `401` once the access token is invalid, and note how long that takes with your token lifetime. Repeat by revoking the access token directly.
Where the kit fits
The MCP Starter Kit ($27) is built for teams putting OAuth-protected remote MCP servers in front of Cursor and Claude Connect. Soft path: start at /free; Cheat Sheet for the skim checklist mindset; kit when you want the auth-ready layout.
Soft next step
Check whether your authorization server exposes an RFC 7009 revocation endpoint, then run the revoke-and-call test above against your MCP server. Soft ladder: /free, then the MCP Starter Kit ($27). Related: OAuth pillar.