MCP Step-Up Authorization vs. OAuth Incremental Authorization: What Actually Changes? “There are no zones.” There were three. TL;DR When Cloudflare announced step-up authorization for its API MCP Server, I wanted to know how it differed from Google OAuth's Incremental Authorization. I read the specs, wrote my own MCP client, and sent 128 requests to the live service. The additional authorization itself is still ordinary OAuth. The difference is a path for the server to t...