Hands-on MCP security, one problem at a time
September 9, 2026 · Granthinge
A reviewer will ask what happens to an agent's access when you disable the user in your IdP. Here is how token lifetime, refresh rotation, revocation, introspection, and shared signals answer that question.
Read moreSeptember 9, 2026 · Granthinge
A directory listing is a security review with a form attached. What to have finished before you submit a remote MCP server, why submissions get sent back, and the parts you cannot fix after the fact.
Read moreSeptember 9, 2026 · Granthinge
A reviewer cannot approve a call; they can only approve a record. The seven documents that make up an evidence pack for an MCP server, and how to keep them true as the specification moves.
Read moreSeptember 9, 2026 · Granthinge
One omnibus scope passes a functional test and fails a security review. How to build a scope catalog, elevate incrementally with insufficient_scope challenges, and log it.
Read moreSeptember 9, 2026 · Granthinge
Authorization decides who may call a tool. Data handling decides what leaves your tenant when they do, and it is the half of the questionnaire most MCP servers cannot answer.
Read more