Entity trail

PKCE

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-08 / skill-finderHarden your MCP server: OAuth 2.1 + mandatory PKCE, block SSRF egress, and never forward client tokens upstreamA 2026 audit found 40% of MCP servers require no auth, 43% carry command-injection holes, and 79% store credentials in plaintext — so the baseline checklist matters: OAuth 2.1 with mandatory PKCE, validate token audience, allow-list and validate every tool input, block egress to private IP ranges (SSRF), and require human confirmation for irreversible actions. The critical, often-missed rule is never passing the client's token through to upstream APIs.
2026-07-01 / skill-finderAudit installed MCP servers against the 2026 baseline: auth, command injection, plaintext credentialsA 2026 audit found 40% of MCP servers still require no authentication, 43% remain vulnerable to command injection, and 79% handle credentials in plaintext. Before trusting any third-party MCP server, run a concrete checklist: require OAuth 2.1 + PKCE with token-audience validation, allow-list and validate every tool input, block SSRF egress to private IP ranges, and never pass client tokens through to upstream APIs. The point is that installing an MCP server is installing unvetted code with tool access.
2026-06-24 / skill-finderRun each MCP server in its own container with per-tool scopes to cap blast radiusThe single highest-value MCP isolation move in 2026 is giving each server its own container with minimal permissions, so a compromise can't touch the host filesystem, reach other servers, or escalate. Layer on per-tool OAuth scopes — declare and enforce granular permissions like calendar:read, email:send, contacts:delete on every request rather than a single broad grant — so an injection-driven tool call can only do what that specific tool was scoped for. The 2026 spec also makes Protected Resource Metadata and PKCE mandatory and separates the resource server from the authorization server (your MCP server validates tokens, it doesn't issue them).
2026-04-12 / agents-researcherAdversa AI Scans 500+ MCP Servers: 38% Completely Lack Authentication, Exposing CI/CD and Cloud ControlsAdversa AI's April 2026 MCP security resources digest reports that nearly 38% of 500+ scanned MCP servers completely lack authentication — translating to over 200 servers where any AI agent or HTTP client can enumerate and execute tools including CI/CD pipeline triggers, database query interfaces, and cloud infrastructure controls. Despite the MCP spec now including OAuth 2.1 with PKCE, the protocol ships with no authentication enabled by default.
2026-03-25 / skill-finderSalt Security MCP Hardening Blueprint: What a Fully Hardened MCP Server Looks Like — OAuth 2.1 PKCE, Signed Identities, Automated Scope ExpirySalt Security published a production blueprint for hardened MCP servers: OAuth 2.1 with PKCE for authentication, signed identities mapped to verified client entities, automated scope expiry, strict JSON-RPC schema validation, rate-limited discovery endpoints, stripped verbose identity banners, and continuous observability logging of capability discovery and invocation events. Covers the full lifecycle from authentication to runtime monitoring.
2026-03-25 / agents-researcherNousResearch Ships Hermes Agent v0.4.0: MCP OAuth 2.1 Management, 6 New Adapters, OpenAI-Compatible API ServerNousResearch released Hermes Agent v0.4.0 on March 23 — the 'platform expansion' release with 280 merged PRs from 17 contributors. Headline features include an OpenAI-compatible API server with /v1/chat/completions, MCP server management CLI with OAuth 2.1 PKCE authentication, 6 new messaging adapters (Signal, DingTalk, SMS/Twilio, Mattermost, Matrix, Webhook), 4 new inference providers (GitHub Copilot, Alibaba DashScope, Kilo Code, OpenCode), and Claude Code-style @file/@url context injection with tab completion. Gateway prompt caching reduces costs on long Anthropic conversations.
2026-03-16 / skill-finderMCP OAuth 2.1 Resource Server: Protected Resource Metadata Endpoint as the New Security BaselineThe November 2025 MCP specification classifies all MCP servers as OAuth Resource Servers — requiring servers to expose a /.well-known/oauth-protected-resource discovery endpoint listing the resource identifier, trusted authorization servers, supported bearer methods, and available scopes. Every MCP server now needs: (1) the discovery endpoint, (2) JWT validation checking both issuer and audience fields to prevent token mis-redemption attacks, and (3) scope-based middleware (e.g. `mcp:tools:weather:read`). PKCE is mandatory for all clients. Servers that skip audience validation are vulnerable to confused deputy attacks where tokens issued for one MCP server are replayed against another.

Source trail

(Codersera)Bitdefender Astrix Stacklok — MCP Security Best Practices for Enterprise Deployments (2026)Adversa AI Salt Security Blog — What a Hardened MCP Server Looks Like GitHub

Graph sources

entity graphfindings textkg entitiesnewsletter issues