Yes. MCP allows (and uses) exactly the same authentication mechanisms that any other rest or similar api allows. So if you have a service you want to expose (or not) via MCP you can do that in exactly the same way as you currently could do that for a rest API.
The difference for the user is instead of them having to make (or use) a special-purpose client to call your rest api, the llm (or llm powered application) can just call the api for them, meaning your rest service can be integrated into other llm-powered workflows.
The llm/or llm powered application is just running the mcp server from the file system so you can use your normal methods ie inject it into the environment, pass it somewhere as a parameter or whatever
The difference for the user is instead of them having to make (or use) a special-purpose client to call your rest api, the llm (or llm powered application) can just call the api for them, meaning your rest service can be integrated into other llm-powered workflows.