August 24, 2026 · Granthinge
Resource indicators bind a token to one server; audience validation is what makes the binding real. How to verify the aud claim on every MCP request, with code and the failure modes reviewers look for.
Read moreAugust 11, 2026 · Granthinge
Most first MCP servers work in the demo and stall in the customer's vendor review, for five consistent reasons: API keys instead of authorization, token passthrough, unscoped tools, no usable audit, and trusted tool text.
Read moreJuly 27, 2026 · Granthinge
'We support OAuth' and 'we implement the MCP authorization flow correctly' are different claims, and the gap between them is what a reviewer checks.
Read more