And there's a concrete PR open at https://github.com/modelcontextprotocol/specification/pull/1... which suggests that there will be an auth capability with both oauth and credential (api keys etc) which seems like it will make it's way into the next release of the spec