I know I'm a bit late. But for MCP servers running over HTTP/custom it should use OAuth 2.0. If it's served via stdout, it should use configuration files and/or environment variables.

ref: https://modelcontextprotocol.io/specification/2025-03-26/bas...