Oauth

CVE-2026-49257 in mcp-pinot shows why network-reachable MCP database servers must fail closed: secure startup, endpoint authentication, and per-tool runtime authorization are all mandatory. This guide breaks down the confused-deputy pattern, risk-tiered tool policy for read vs schema/admin operations, and the audit model needed for real incident forensics.

Subagents are delegated actors, not implementation details. This guide explains how to design MCP permission delegation, OAuth token brokering, approval routing, and audit trails to avoid silent stalls and privilege expansion.

Atlassian Rovo's MCP server makes a precise security tradeoff visible: OAuth 2.1 handles identity and consent; API tokens handle non-interactive automation. Neither governs what agents can actually do at tool-call time. Here is what that gap looks like in practice.

The Claude Code MCP OAuth token theft chain is an authorization failure, not just a credential leak. OAuth got the agent connected, but it never constrained which tool calls remained valid after the routing layer was tampered with — and that is the gap runtime policy enforcement must close.

Microsoft Entra Agent ID and SD-JWT agent identity solve registration, governance, and authentication — but they don't decide whether a specific MCP tool call is permissible right now. This article explains the gap and the runtime authorization architecture needed to close it.

OAuth 2.1 is the right foundation for MCP security, but most implementations stop one layer too early. This guide covers every spec-required piece: protected resource metadata, authorization server discovery, PKCE, dynamic client registration, resource indicators, and where fine-grained authorization picks up where OAuth ends.

AI agents acting across tools, APIs, and multi-agent pipelines raise hard questions about identity, authentication, and authorization. This article covers agentic identity (delegating human + workflow context + intent), agent interrogation, SPIFFE, OAuth token exchange, least privilege at runtime, and what audit actually means for agentic systems.

Learn what identity tokens are, how they work, and best practices for using them securely in modern applications. Avoid common pitfalls and strengthen your app’s authentication and authorization.

Explore the essential guide to OAuth Tokens. Learn about Access Tokens and Refresh Tokens for secure user authentication and authorization.

Explore JWT and OAuth distinct roles in web app security, how they work together, and their importance in modern web development.

Explore token-based authentication, its advantages over sessions, various token types, and the role of authorization tokens in security.

Discover top open-source auth projects enhancing application security, including Hanko, Supabase, and OPAL, for robust authentication and authorization.

Learn how, when, and where to use OAuth scopes for authorization. Get a clear understanding of OAuth scopes definition and their proper usage.