Hands-on MCP security, one problem at a time
September 9, 2026 · Granthinge
A bearer token that leaks is a bearer token that works. Here is how DPoP (RFC 9449) and mTLS-bound tokens (RFC 8705) apply to an MCP server, what each one costs, and when you do not need either.
Read moreSeptember 9, 2026 · Granthinge
The MCP specification tells your server not to pass the incoming token onward. This is what to do instead: validate the token you were given, then use RFC 8693 token exchange to obtain a downstream token that still names the user.
Read moreSeptember 9, 2026 · Granthinge
Many MCP servers need a credential for a system they do not own. Here is how to link a user's third-party account, store the tokens, and keep the server from becoming a confused deputy that lends one user's access to another.
Read moreSeptember 9, 2026 · Granthinge
Authorization is only half of a remote MCP server. The other half is the transport: session identifiers, Origin checks, DNS rebinding, stream resumption, and what happens to an open stream when a token is revoked.
Read moreSeptember 9, 2026 · Granthinge
Elicitation and sampling reverse the direction of an MCP session: the server asks, the client answers. Here is how to design and review those requests so they do not become a credential channel or a confused deputy.
Read more