October 5, 2026 · Granthinge
What to do in the first hour after an MCP server incident: contain the tokens, read the audit trail, meet the notification clock, and keep the directory listing.
Read moreSeptember 28, 2026 · Granthinge
Protocol revision 2026-07-28 removes sessions and the initialize handshake. Here is what that does to handle binding, retry authorization, and the audit fields a reviewer already saw.
Read moreSeptember 21, 2026 · Granthinge
When authorization rules stop fitting in handler code, the answer is a policy decision point. Here is when to externalize MCP tool authorization, what the interface looks like, and what it costs.
Read moreSeptember 21, 2026 · Granthinge
Enterprise buyers increasingly want the identity provider, not the end user, to decide which agent may reach your MCP server. Here is how IdP-brokered access works, what the draft grant does, and what to build now.
Read moreSeptember 16, 2026 · Granthinge
Tools get the security attention. Resources, resource templates, subscriptions, and prompts are served by the same server and are usually authorized far less carefully. Here is how to close that gap.
Read moreSeptember 15, 2026 · Granthinge
A working method for threat modeling an MCP server: draw the five trust boundaries, enumerate abuse cases per boundary, and turn the result into the diagram and control matrix a reviewer will accept.
Read moreSeptember 14, 2026 · Granthinge
Scheduled and background agents call MCP servers with no user in the loop. Here is how to authorize them without a shared service account, and how to keep the audit trail answerable.
Read moreSeptember 11, 2026 · Granthinge
A task ID is not a credential. How to authorize long-running MCP tool calls: binding the task to the principal, tokens that expire mid-run, revocation reaching in-flight work, cancellation, and the audit events a reviewer expects.
Read moreSeptember 10, 2026 · Granthinge
Scopes say what a token may ask for. They do not say which employee should have had it. How to get group and entitlement data out of a customer IdP and into an MCP server’s decisions.
Read moreSeptember 9, 2026 · Granthinge
A bearer token that leaks is a bearer token that works. Here is how DPoP (RFC 9449) and mTLS-bound tokens (RFC 8705) apply to an MCP server, what each one costs, and when you do not need either.
Read moreSeptember 9, 2026 · Granthinge
The MCP specification tells your server not to pass the incoming token onward. This is what to do instead: validate the token you were given, then use RFC 8693 token exchange to obtain a downstream token that still names the user.
Read moreSeptember 9, 2026 · Granthinge
Many MCP servers need a credential for a system they do not own. Here is how to link a user's third-party account, store the tokens, and keep the server from becoming a confused deputy that lends one user's access to another.
Read moreSeptember 9, 2026 · Granthinge
Authorization is only half of a remote MCP server. The other half is the transport: session identifiers, Origin checks, DNS rebinding, stream resumption, and what happens to an open stream when a token is revoked.
Read moreSeptember 9, 2026 · Granthinge
A reviewer will ask what happens to an agent's access when you disable the user in your IdP. Here is how token lifetime, refresh rotation, revocation, introspection, and shared signals answer that question.
Read moreSeptember 9, 2026 · Granthinge
A reviewer cannot approve a call; they can only approve a record. The seven documents that make up an evidence pack for an MCP server, and how to keep them true as the specification moves.
Read moreSeptember 9, 2026 · Granthinge
One omnibus scope passes a functional test and fails a security review. How to build a scope catalog, elevate incrementally with insufficient_scope challenges, and log it.
Read moreSeptember 9, 2026 · Granthinge
Dynamic client registration is the default answer for MCP, and it is the one enterprise reviewers question first. Here is how to decide which agent clients may connect to your server, and how to prove it.
Read moreAugust 24, 2026 · Granthinge
Resource indicators bind a token to one server; audience validation is what makes the binding real. How to verify the aud claim on every MCP request, with code and the failure modes reviewers look for.
Read moreAugust 20, 2026 · Granthinge
The discovery handshake is the first thing an MCP client runs against your server. A hands-on walkthrough of RFC 9728 protected resource metadata: the pointing 401, the well-known document, and how to test both.
Read moreJuly 27, 2026 · Granthinge
'We support OAuth' and 'we implement the MCP authorization flow correctly' are different claims, and the gap between them is what a reviewer checks.
Read moreJuly 8, 2026 · Granthinge
Perfect OAuth with badly designed tools is still a liability: here is how to design MCP tools so the agent cannot do more than the human.
Read more