Six MCP SDKs lack the dual-persona auth enterprises need.

A gap analysis across the Python, TypeScript, Go, Rust, C# and Swift SDKs names three structural shortcomings: credential extraction bound to a single Authorization header, no pre-authentication tool discovery, and no fine-grained per-tool authorization in the base SDKs. The first bites hardest for a server that must serve human users over corporate SSO and automated agents over service-account credentials on a different header, which today requires custom middleware everywhere. The paper ships composable FastMCP extensions adding cross-header credential normalization, cached token verification across heterogeneous IdPs, and an unauthenticated metadata endpoint for registry discovery. (arXiv 2609.22573)