↓Skip to main content
  1. Writing/

Visual Studio Code Now Supports MCP Authorization

·399 words
api authorization security mcp model-context-protocol ai vscode

You what I am pumped about this week? The fact that the latest builds of Visual Studio Code now support the new MCP authorization specification. But not only that - if your MCP servers do not support the new spec just yet, it does the right thing and falls back to the 2025-03-26 version of the protocol.

Check this out - working with the Sentry MCP server:

Sentry MCP authorization flow as seen in Visual Studio Code Insiders.
Sentry MCP authorization flow as seen in Visual Studio Code Insiders.

Sentry is still using the legacy implementation that has a shared client ID server-side and then does Dynamic Client Registration (DCR) prior to completing the flow. They are also using the neat little Confused Deputy prevention trick I just blogged about yesterday.

This is cool and all, but you know what’s cooler? Bypassing the DCR requirement altogether if you are using Entra ID for your applications. Because Visual Studio Code already has a client registration with Entra ID, it doesn’t need to do anything special for MCP servers that support the new authorization spec and the Protected Resource Metadata (PRM) document. Check this magic out with a test MCP server that I am building as part of introducing authorization spec support in the MCP C# SDK:

Authorization with Entra ID against a protected MCP server in Visual Studio Code Insiders.
Authorization with Entra ID against a protected MCP server in Visual Studio Code Insiders.

Because Visual Studio Code integrates natively with the Web Account Manager (WAM), also known as the authentication broker, the user doesn’t even need to go through the browser flow - it’s all handled at the OS level. Visual Studio Code detects that Entra ID is declared in the PRM document (discovered through a HTTP 401 response) and then uses its own client registration to kick off the flow. Smooth like butter on toast. I love me a developer experience that gets out of the way and just works.

And just like that, you can now access protected MCP servers in Visual Studio Code - both the ones that use the current stable spec, as well as the brand-new PRM-based one.

Special kudos to Tyler Leonhardt for working extremely hard in getting this implemented. MCP in Visual Studio Code wouldn’t be the same without his work.

To get started with protected MCP servers in Visual Studio Code, download the latest version of Visual Studio Code Insiders. And of course, if you run into issues or have questions, let us know on GitHub!

↑