English(EN)Adding OAuth to a remote MCP server, and five checks that catch the usual bugs
MCP集成OAuth 2.1，为安全的AI客户端-服务器交互提供支持 · 跟踪4个来源
作者PulseAugur 编辑部·[7 个来源]·
模型上下文协议（MCP）正在与OAuth 2.1集成，以增强AI客户端与远程服务器交互的安全性。此次集成使MCP服务器能够充当OAuth 2.0资源服务器，验证由单独的授权服务器颁发的访问令牌。该过程包括客户端获取令牌，在HTTP请求中提供令牌，以及服务器在执行操作之前验证令牌的真实性和范围。关键方面包括使用受保护资源元数据（PRM）进行发现、动态客户端注册以及处理桌面应用程序和编辑器等各种客户端类型。
AI
<p><em>This article was written by an AI agent. All code below was run on November 13, 2026 with Python 3.13, using only the standard library, on loopback HTTP.</em></p> <p>A local MCP server over STDIO can take credentials from the environment. A remote MCP server over HTTP cann…
<p>An MCP server that only reads public docs can be open to anyone. The moment it touches user data or calls an API, it has to answer three questions: who is connecting, what are they allowed to do, and whose permissions does each call run with?</p> <p>This guide explains how MCP…
<p>Connecting an AI assistant to your API is powerful, so it should be deliberate. Who is connecting? What are they allowed to do? Whose permissions does each call run with?</p> <p>Every DocStar <a href="https://docstar.io/blog/docs-ai-agent-toolkit-docstar-mcp-servers" rel="noop…
dev.to — MCP tag
TIER_1English(EN)·Ignacio Gonzalez Bohorquez·
<p>Table of contents</p> <ol> <li>The running example</li> <li>The three parties</li> <li>One complete flow at a glance</li> <li>Step 1: The client tries the MCP operation</li> <li>Step 2: The client reads PRM</li> <li>Step 3: The client reads authorization server metadata</li> <…
<p>Two weeks ago we put a remote MCP server in front of our reviews API. It lets Claude, Cursor, VS Code and other MCP clients read reviews from the 84 platforms the API covers, and publish a reply, with the user's approval, on the ones whose API allows replies. (How few of them …
<p><em>Originally published at <a href="https://geekcoding101.com/posts/mcp-authorization-oauth-2-1" rel="noopener noreferrer">GeekCoding101</a>.</em></p> <p>You put an MCP server on an HTTP port, and now anyone who can reach that port can call your tools. That is the problem MCP…
<p>When an agent calls an MCP tool on behalf of a signed-in user, something has to authorize the downstream API. The tempting shortcut is to hand the user's access token to the MCP server and let it forward that Bearer token unchanged. That pattern is easy to build and easy to ge…
