Any service offering MCP that doesn't already have OAuth set up is going to have to build out that support first, so instead they just go for a simple API token

Any service offering MCP that doesn't already have OAuth set up is going to have to build out that support first, so instead they just go for a simple API token. I wouldn't call it trivial to drop in OAuth either because the authentication is one part, but wiring it up into whatever authorization set up they have is another bit of work. An AI agent would get the most benefit out of OAuth + ephemeral service accounts (the user is having a bot act on behalf of it) + fine grained scopes.