» Tag
oauth
14 posts6 MCP Servers, One Agent: What the Token Bill Really Showed
An engineer benchmarked 6 MCP servers on one agent, exposing hidden token, latency, and OAuth costs — and the four fixes that cut spend by 53%.
$13,337 Bounty: Google Device Code Flow Account Takeover Bug
Google paid a $13,337 bounty for a confused-deputy flaw in its RFC 8628 device authorization flow enabling account takeover.
MCP 2026-07-28 Spec: Protocol Core Goes Stateless
MCP's 2026-07-28 spec drops sessions for a stateless core, adds MRTR, cacheable list responses, and CIMD-based auth hardening.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comIETF Publishes Best Current Practice for Cross-Device Flow Security
New IETF BCP (RFC 10027) details cross-device flow security threats, real-world exploits, and mitigation strategies for engineers and architects.
MCP Security: Trust Boundaries and the Attacks the Spec Won't Stop
A breakdown of MCP's four trust boundaries, stdio server risks, OAuth 2.1/PKCE/CIMD updates, and the confused-deputy attack class engineers must handle.
How to Build an MCP Server for Your SaaS: Lessons Learned
Learn how to set up an MCP server for your SaaS. Insights and tips from my experience.
MCP Clients Can't Easily Authenticate With Entra: mcp-sso Bridges It
MCP servers can't easily complete OAuth with Entra ID or Cloudflare Access because they lack Dynamic Client Registration; mcp-sso bridges the gap.
AgentForger: ChatGPT URL Param Exploit Creates Rogue Workspace Agents
A vulnerability in ChatGPT's Agent Builder allowed unauthorized agent creation via URL parameters, raising security concerns for engineers.
Securing Remote MCP Servers in C#: OAuth 2.0 and JWT Implementation
Learn how to secure remote MCP servers in C# using OAuth 2.0 and JWT for authentication.
Logging Into Higgsfield CLI on a Headless Server: The localhost Trap
Why OAuth PKCE CLI logins fail on headless servers: localhost is per-machine, redirect URIs are allowlisted, and how replaying the callback URL manually solves it.