The Model Context Protocol's June 2025 specification revision changes how MCP servers handle identity and authorization, and the change is worth flagging because it closes a real gap. Previously, MCP's authorization model was vague about where a server's trust boundary sat. The updated spec (2025-06-18) now classifies MCP servers explicitly as OAuth 2.0 Resource Servers. That means a server exposing tools or data to an AI agent must publish protected resource metadata so a client can discover which Authorization Server actually issues tokens for it, rather than assuming a single shared authorization flow across an ecosystem of servers. Paired with that, the spec now requires MCP clients to implement Resource Indicators as described in RFC 8707. This closes a specific attack path: a malicious or compromised MCP server obtaining an access token that was actually scoped for a different, legitimate server, then replaying it to impersonate the client elsewhere. Resource Indicators force a client to bind each token request to the specific resource server it's talking to, so a token minted for Server A can't be silently reused against Server B. The changelog also elevates several MUST-level requirements that were previously SHOULD, including the negotiated protocol version being carried on every subsequent request via an `MCP-Protocol-Version` header when using HTTP transport. That's a smaller change but it matters for the same reason: it removes ambiguity about which version of the trust and capability contract two parties are actually operating under, which is exactly the kind of gap that becomes a security bug once agents start chaining calls across multiple servers without a human in the loop. What's notable here isn't the OAuth mechanics themselves, which are well-established in web security. It's that a protocol designed for connecting AI models to tools and data sources is now treating server identity and token scoping as first-class, mandatory concerns rather than implementation details left to each vendor. As agents increasingly call other agents' MCP servers autonomously, without a user click-through to notice something's wrong, that kind of explicit resource-server classification is what stands between "the model has scoped, revocable access" and "the model is holding a bearer token that works anywhere." The full technical diff between the 2025-03-26 and 2025-06-18 revisions is public on GitHub for anyone who wants to verify the specific PRs behind each change.