Hands-on MCP security, one problem at a time
August 11, 2026 · Granthinge
Most first MCP servers work in the demo and stall in the customer's vendor review, for five consistent reasons: API keys instead of authorization, token passthrough, unscoped tools, no usable audit, and trusted tool text.
Read moreJuly 27, 2026 · Granthinge
'We support OAuth' and 'we implement the MCP authorization flow correctly' are different claims, and the gap between them is what a reviewer checks.
Read moreJuly 8, 2026 · Granthinge
Perfect OAuth with badly designed tools is still a liability: here is how to design MCP tools so the agent cannot do more than the human.
Read more