Instead of trying to find workarounds, however viable those might be, myself and a few identity and security experts, along with some folks from the broader MCP community worked on putting together a Request For Comments (RFC) document that aims to simplify and future-proof a bit the current MCP authorization specification. With the proliferation of MCP, there is a greater need to make sure that we establish a set of baseline standards that help developers build secure MCP servers as well as MCP clients that can talk to them. The current MCP authorization specification sets us on that path, but does require quite a bit of work for a developer to get things right, such as implementing the OAuth 2.1 PKCE flows from scratch.