For my app I'm bypassing MCP auth and doing the regular oauth2 flow to connect users to external apps.

Then I pass the stored oauth token directly to my (private) MCP servers alongside a bearer token.