October 5, 2026 · Granthinge
What to do in the first hour after an MCP server incident: contain the tokens, read the audit trail, meet the notification clock, and keep the directory listing.
Read moreSeptember 28, 2026 · Granthinge
Protocol revision 2026-07-28 removes sessions and the initialize handshake. Here is what that does to handle binding, retry authorization, and the audit fields a reviewer already saw.
Read moreSeptember 21, 2026 · Granthinge
The MCP Apps extension lets a tool return an interactive interface instead of text. It also puts your HTML inside the host, talking back over postMessage. Here is what a reviewer will ask about that, and what the server has to enforce.
Read moreSeptember 21, 2026 · Granthinge
When authorization rules stop fitting in handler code, the answer is a policy decision point. Here is when to externalize MCP tool authorization, what the interface looks like, and what it costs.
Read moreSeptember 21, 2026 · Granthinge
Enterprise buyers increasingly want the identity provider, not the end user, to decide which agent may reach your MCP server. Here is how IdP-brokered access works, what the draft grant does, and what to build now.
Read moreSeptember 18, 2026 · Granthinge
Authorization is only half of what a reviewer asks about. The other half is where the server runs: its network boundary, what it is allowed to call outbound, how it holds secrets, and how a customer's data stays inside the region they were promised.
Read moreSeptember 17, 2026 · Granthinge
Reviewers now ask what code runs inside your MCP server and who wrote it: SDK pinning as a spec decision, SBOM and provenance, an inventory for servers you did not write, and a vulnerability intake path.
Read moreSeptember 16, 2026 · Granthinge
Tools get the security attention. Resources, resource templates, subscriptions, and prompts are served by the same server and are usually authorized far less carefully. Here is how to close that gap.
Read moreSeptember 15, 2026 · Granthinge
A working method for threat modeling an MCP server: draw the five trust boundaries, enumerate abuse cases per boundary, and turn the result into the diagram and control matrix a reviewer will accept.
Read moreSeptember 14, 2026 · Granthinge
A tool description is executable text that reaches the model. If it can change silently between two sessions, your customer has no way to know what their agent was told. Here is how to version, publish, and evidence tool changes.
Read moreSeptember 14, 2026 · Granthinge
Agents retry, loop, and fan out. Here is how to put per-user quotas, per-tool limits, and backpressure on an MCP server, and what to tell a reviewer who asks about availability and cost.
Read moreSeptember 14, 2026 · Granthinge
Scheduled and background agents call MCP servers with no user in the loop. Here is how to authorize them without a shared service account, and how to keep the audit trail answerable.
Read moreSeptember 11, 2026 · Granthinge
A task ID is not a credential. How to authorize long-running MCP tool calls: binding the task to the principal, tokens that expire mid-run, revocation reaching in-flight work, cancellation, and the audit events a reviewer expects.
Read moreSeptember 10, 2026 · Granthinge
Scopes say what a token may ask for. They do not say which employee should have had it. How to get group and entitlement data out of a customer IdP and into an MCP server’s decisions.
Read moreSeptember 9, 2026 · Granthinge
The MCP specification tells your server not to pass the incoming token onward. This is what to do instead: validate the token you were given, then use RFC 8693 token exchange to obtain a downstream token that still names the user.
Read moreSeptember 9, 2026 · Granthinge
Authorization is only half of a remote MCP server. The other half is the transport: session identifiers, Origin checks, DNS rebinding, stream resumption, and what happens to an open stream when a token is revoked.
Read moreSeptember 9, 2026 · Granthinge
Elicitation and sampling reverse the direction of an MCP session: the server asks, the client answers. Here is how to design and review those requests so they do not become a credential channel or a confused deputy.
Read moreSeptember 9, 2026 · Granthinge
A reviewer will ask what happens to an agent's access when you disable the user in your IdP. Here is how token lifetime, refresh rotation, revocation, introspection, and shared signals answer that question.
Read moreSeptember 9, 2026 · Granthinge
A directory listing is a security review with a form attached. What to have finished before you submit a remote MCP server, why submissions get sent back, and the parts you cannot fix after the fact.
Read moreSeptember 9, 2026 · Granthinge
A reviewer cannot approve a call; they can only approve a record. The seven documents that make up an evidence pack for an MCP server, and how to keep them true as the specification moves.
Read moreSeptember 9, 2026 · Granthinge
Authorization decides who may call a tool. Data handling decides what leaves your tenant when they do, and it is the half of the questionnaire most MCP servers cannot answer.
Read moreSeptember 9, 2026 · Granthinge
Dynamic client registration is the default answer for MCP, and it is the one enterprise reviewers question first. Here is how to decide which agent clients may connect to your server, and how to prove it.
Read moreSeptember 9, 2026 · Granthinge
Request logs are not audit. Here is an event schema for MCP tool calls that a customer's security team can ingest, correlate, and hand to an auditor, and how to get it out of your server without inventing a format.
Read moreSeptember 9, 2026 · Granthinge
The test sequence we run against an MCP server before handover: token fixtures, the four authorization rejections, exhaustive cross-tenant checks, prompt injection containment, session replay, and the record a reviewer reads.
Read moreAugust 24, 2026 · Granthinge
Resource indicators bind a token to one server; audience validation is what makes the binding real. How to verify the aud claim on every MCP request, with code and the failure modes reviewers look for.
Read moreAugust 11, 2026 · Granthinge
Most first MCP servers work in the demo and stall in the customer's vendor review, for five consistent reasons: API keys instead of authorization, token passthrough, unscoped tools, no usable audit, and trusted tool text.
Read moreJuly 27, 2026 · Granthinge
'We support OAuth' and 'we implement the MCP authorization flow correctly' are different claims, and the gap between them is what a reviewer checks.
Read more