§Filed under · Tag archive
API Design.
02 posts
- 01
MCP Server Authorization: The Token You Must Never Forward
A valid token is not permission. Here's how OAuth works for MCP servers, why scopes don't replace object-level checks, and the passthrough mistake that turns your server into a confused deputy.
MCPSecurityOAuthAI Agents22 mins read - 02
MCP Server Design Is Changing: From API Endpoints to Agent Workflows
One-to-one API-to-tool mapping is the easiest way to build an MCP server and one of the easiest ways to build a bad one. Here's the two-layer pattern replacing it.
MCPAI AgentsAnthropicAgent Architecture17 mins read