MCP can use HTTP or STDIO as transports.

There is no need to implement a new form of authentication that's specific to the protocol because you already have a myriad of options available with HTTP.

Any form of auth used to secure a web service can be used with MCP. It's no different than adding authN to a REST API.

Please just read the spec. It just builds on top of JSON-RPC, there's nothing special or inherently new about this protocol.

https://modelcontextprotocol.io/specification/2025-03-26

There are way too many commentators like yourself that have no idea what they are talking about because they couldn't be bothered to RTFM.