September 21, 2026 · Granthinge
The MCP Apps extension lets a tool return an interactive interface instead of text. It also puts your HTML inside the host, talking back over postMessage. Here is what a reviewer will ask about that, and what the server has to enforce.
Read moreSeptember 16, 2026 · Granthinge
Tools get the security attention. Resources, resource templates, subscriptions, and prompts are served by the same server and are usually authorized far less carefully. Here is how to close that gap.
Read moreSeptember 14, 2026 · Granthinge
A tool description is executable text that reaches the model. If it can change silently between two sessions, your customer has no way to know what their agent was told. Here is how to version, publish, and evidence tool changes.
Read moreSeptember 14, 2026 · Granthinge
Agents retry, loop, and fan out. Here is how to put per-user quotas, per-tool limits, and backpressure on an MCP server, and what to tell a reviewer who asks about availability and cost.
Read moreSeptember 9, 2026 · Granthinge
Elicitation and sampling reverse the direction of an MCP session: the server asks, the client answers. Here is how to design and review those requests so they do not become a credential channel or a confused deputy.
Read moreSeptember 9, 2026 · Granthinge
A directory listing is a security review with a form attached. What to have finished before you submit a remote MCP server, why submissions get sent back, and the parts you cannot fix after the fact.
Read moreSeptember 9, 2026 · Granthinge
One omnibus scope passes a functional test and fails a security review. How to build a scope catalog, elevate incrementally with insufficient_scope challenges, and log it.
Read moreSeptember 9, 2026 · Granthinge
Authorization decides who may call a tool. Data handling decides what leaves your tenant when they do, and it is the half of the questionnaire most MCP servers cannot answer.
Read moreSeptember 9, 2026 · Granthinge
Request logs are not audit. Here is an event schema for MCP tool calls that a customer's security team can ingest, correlate, and hand to an auditor, and how to get it out of your server without inventing a format.
Read moreSeptember 9, 2026 · Granthinge
The test sequence we run against an MCP server before handover: token fixtures, the four authorization rejections, exhaustive cross-tenant checks, prompt injection containment, session replay, and the record a reviewer reads.
Read moreAugust 11, 2026 · Granthinge
Most first MCP servers work in the demo and stall in the customer's vendor review, for five consistent reasons: API keys instead of authorization, token passthrough, unscoped tools, no usable audit, and trusted tool text.
Read moreJuly 8, 2026 · Granthinge
Perfect OAuth with badly designed tools is still a liability: here is how to design MCP tools so the agent cannot do more than the human.
Read more