Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)

MCP solved client-to-server auth with OAuth 2.1, but the host itself has no identity of its own. WSO2’s Ayesha Dissanayaka breaks down the Four A’s framework and OAuth On-Behalf-Of tokens for securing AI agent hosts in production.