August 24, 2026 · Granthinge
Resource indicators bind a token to one server; audience validation is what makes the binding real. How to verify the aud claim on every MCP request, with code and the failure modes reviewers look for.
Read moreAugust 20, 2026 · Granthinge
The discovery handshake is the first thing an MCP client runs against your server. A hands-on walkthrough of RFC 9728 protected resource metadata: the pointing 401, the well-known document, and how to test both.
Read moreJuly 27, 2026 · Granthinge
'We support OAuth' and 'we implement the MCP authorization flow correctly' are different claims, and the gap between them is what a reviewer checks.
Read moreJuly 8, 2026 · Granthinge
Perfect OAuth with badly designed tools is still a liability: here is how to design MCP tools so the agent cannot do more than the human.
Read more