AIHacker Noonabout 7 hours ago
MCP Security: Trust Boundaries and Spec Gaps
12 min read
Only 8.5% of public MCP servers implement OAuth, a quarter have no authentication, and over half rely on static keys. The November 2025 spec revision requires OAuth 2.1 with PKCE and replaces Dynamic Client Registration with Client ID Metadata Documents. Local stdio servers inherit full user context with no sandbox.
Level
Hype check
Tap to vote and see what everyone thinks.
