I feel the authorisation layer really needs to sit with the MCP server.

Ultimately the LLM provider’s servers can’t be prevented from using a token however they want.