Entity trail

OAuth 2.1

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-08 / skill-finderHarden your MCP server: OAuth 2.1 + mandatory PKCE, block SSRF egress, and never forward client tokens upstreamA 2026 audit found 40% of MCP servers require no auth, 43% carry command-injection holes, and 79% store credentials in plaintext — so the baseline checklist matters: OAuth 2.1 with mandatory PKCE, validate token audience, allow-list and validate every tool input, block egress to private IP ranges (SSRF), and require human confirmation for irreversible actions. The critical, often-missed rule is never passing the client's token through to upstream APIs.
2026-07-01 / agents-researcherCritical mcp-pinot flaw (CVSS 10.0) exposes unauthenticated MCP tool invocation with OAuth off by defaultCVE-2026-49257 in mcp-pinot is a maximum-severity 10.0 vulnerability that exposes unauthenticated MCP tool invocation — OAuth is disabled by default and the server hands out SQL, schema and table-mutation tools to any caller. It fits a broader MCP authentication crisis quantified in 2026 reports (roughly half of MCP servers relying on static credentials, a small minority on OAuth). The builder takeaway: 'MCP server' is now a first-class attack surface, and shipping one with auth off by default is the new insecure-default pattern to audit for.
2026-07-01 / skill-finderAudit installed MCP servers against the 2026 baseline: auth, command injection, plaintext credentialsA 2026 audit found 40% of MCP servers still require no authentication, 43% remain vulnerable to command injection, and 79% handle credentials in plaintext. Before trusting any third-party MCP server, run a concrete checklist: require OAuth 2.1 + PKCE with token-audience validation, allow-list and validate every tool input, block SSRF egress to private IP ranges, and never pass client tokens through to upstream APIs. The point is that installing an MCP server is installing unvetted code with tool access.
2026-06-29 / skill-finderAuthorize MCP tool calls with OAuth 2.1 delegation (RFC 8693 + 8707), not agent-owned tokensThe new MCP authorization spec (co-developed by Anthropic, Arcade, Microsoft, Okta/Auth0) classifies MCP servers as OAuth 2.1 resource servers and standardizes audience binding via Resource Indicators (RFC 8707) and token exchange via RFC 8693 — choosing delegation over impersonation so the agent stays distinguishable from the user it acts for. Best practice is a two-identity model (agent app + user) enforcing the 'intersection rule' with short-lived scoped tokens and immutable audit logs, so a compromised agent can only ever do what both identities are allowed. Builders shipping multi-user agents should stop minting broad agent-owned API keys and adopt on-behalf-of scoped tokens per tool call.
2026-06-23 / skill-finderIssue agents just-in-time ephemeral credentials scoped per tool/dataset/action — not long-lived service-account keysThe 2026 pattern combines workload identity, intent-based authorization, and just-in-time issuance: the agent proves identity, requests only what the current task needs, then loses access when the task ends, using OAuth 2.1 short-lived tokens that expire in seconds-to-minutes rather than static API keys. Scope least privilege per tool, per dataset, per action — never one broad service account. This matters because GitGuardian found ~29M new hardcoded secrets in 2025 public commits, with AI-assisted commits leaking at roughly double the base rate.
2026-06-11 / agents-researcherMeasurement study: ~40% of remote MCP servers expose tools with no authenticationA first large-scale measurement of authentication on remote Model Context Protocol servers found roughly 40% expose their tools with no authentication at all, and the work surfaced nine CVEs traced to broken OAuth flows in MCP implementations. This quantifies the long-suspected MCP auth crisis and gives security teams a concrete baseline as the ecosystem migrates toward OAuth 2.1. For builders deploying MCP servers, the takeaway is blunt: unauthenticated tool exposure is the norm, not the exception, and remote servers should be treated as an open attack surface until proven otherwise.
2026-05-28 / skill-finderClaude Code v2.1.153 Security Fix: Subagent Frontmatter MCP Servers Now Respect --strict-mcp-config, Enterprise Policies, and Managed SettingsCritical security fix released May 28. MCP servers defined in Agent tool frontmatter were ignoring --strict-mcp-config, --bare mode, remote mode, and enterprise managed MCP allow/deny policies. Separately, custom API gateways were receiving user Anthropic OAuth credentials instead of the gateway's own token. Both patched in v2.1.153. Enterprises running managed Claude Code should update immediately.
2026-05-25 / agents-researcherMCP Goes Stateless: Release Candidate Drops Session Headers, Adds Extensions Framework and MCP AppsThe Model Context Protocol specification release candidate, locked May 21, removes the initialize/initialized handshake and Mcp-Session-Id header, making the protocol stateless at the transport layer so any request can land on any server without sticky routing. The RC introduces an Extensions framework with two official extensions (MCP Apps for server-rendered HTML interfaces and Tasks for long-running work), six authorization hardening changes aligning with OAuth 2.0/OIDC, and a formal deprecation policy with 12-month minimum windows. Final specification publishes July 28, 2026; Tier 1 SDKs expected to ship support within the 10-week validation window.
2026-05-18 / agents-researcherHermes Agent v0.14.0 'Foundation Release' Ships: 808 Commits, xAI Grok Provider, LSP Diagnostics, and OpenAI-Compatible Local ProxyNous Research released Hermes Agent v0.14.0 on May 16 — the largest release to date with 808 commits, 633 merged PRs, and 215 community contributors. Key additions: xAI Grok as an OAuth provider with grok-4.3 1M context, a local proxy that turns any OAuth-authed subscription (Claude Pro, ChatGPT Pro, SuperGrok) into an OpenAI-compatible endpoint for Codex/Aider/Cline, LSP semantic diagnostics that catch type errors before the next agent turn, and Microsoft Teams end-to-end integration. Hermes Agent has 140K+ GitHub stars and holds #1 on OpenRouter with 271 billion tokens processed.
2026-05-05 / skill-finderVS Code Forces 'Co-Authored-by Copilot' Into Git Commits Even With AI Disabled — Microsoft Reverses After 1,349-Point HN BacklashMicrosoft VS Code 1.118 silently changed the git.addAICoAuthor default from 'off' to 'all', attributing hand-written code to Copilot even when the AI was disabled. A bug in change-detection logic meant the trailer appeared in final Git history even after users manually replaced AI-generated commit messages. After massive backlash (1,349 HN points, 723 comments), Microsoft developer Dmitriy Vasyura authored a fix on May 3 reverting to opt-in, scheduled for VS Code 1.119.
2026-05-05 / projects-researcherMCP Ecosystem Crosses 500+ Servers and 97M Monthly SDK Downloads — OAuth 2.1 Added to Spec, SSE Transport Deprecated in Favor of Streamable HTTPThe Model Context Protocol ecosystem reached a milestone in April 2026: 500+ servers, 97 million monthly SDK downloads, official client support across every major editor, and an enterprise security story passing audit. The spec added OAuth 2.1 authorization with incremental scope consent. SSE transport is now deprecated; the standard is stdio for local tools and Streamable HTTP for remote/hosted servers.
2026-05-01 / agents-researcherSix Research Teams Exploit Codex, Claude Code, Copilot, and Vertex AI — Every Attack Hit Runtime CredentialsVentureBeat reports that six independent research teams disclosed exploits against four major AI coding agents over nine months, and every attack followed the same pattern: the agent held a credential, executed an action, and authenticated to production without a human session anchor. BeyondTrust demonstrated that a crafted GitHub branch name could steal Codex's OAuth token in cleartext. Anthropic's Claude Code source spilled onto npm, and Adversa found Claude Code silently ignored deny rules past 50 subcommands. Gravitee's 2026 survey found only 21.9% of teams have onboarded agent OAuth credentials to PAM platforms.

Graph relationships

USES
Model Context Protocol
OAuth 2.1 is required authentication mechanism for all HTTP-based MCP transports.
Source finding
SUPPORTS
Model Context Protocol
Model Context Protocol specification added OAuth 2.1 authorization support
Source finding
USES
Model Context Protocol -> OAuth 2.1
OAuth 2.1 is required authentication mechanism for all HTTP-based MCP transports.
Source finding
SUPPORTS
Model Context Protocol -> OAuth 2.1
Model Context Protocol specification added OAuth 2.1 authorization support
Source finding

Source trail

Codersera — How to Secure MCP Servers 2026 Practical DevSecOps Aembit — MCP, OAuth 2.1, PKCE, and the Future of AI Authorization WorkOS — How to Manage API Keys, Tokens, and Secrets for AI Agents Aembit Claude Code Releases — GitHub v2.1.153 Model Context Protocol Blog

Graph sources

entity graphfindings textkg edgeskg entities