Engineering insights
Deep-dives on MCP security, RFC explainers, and war stories from the field.
Cross-App Access: Why Enterprise MCP Needs IdP-Mediated Authorization
XAA (Cross-App Access) puts the enterprise IdP in the loop for every agent-to-tool connection. Here's how ID-JAG works, why it matters for regulated industries, and how AuthPlane implements it.
OAuth 2.1 + PKCE Is the Only Right Way to Secure MCP
The MCP authorization spec mandates OAuth 2.1 with mandatory PKCE for a reason. Here's exactly why every alternative falls apart — and what your MCP server needs to implement correctly.
What We Saw When Teams Shipped MCP Without Auth
Four real attack patterns we observed in unprotected MCP deployments: token replay, log scraping, scope escalation, and zero audit trail. What goes wrong and how to fix it.
Reading RFC 9728 So You Don't Have To
Protected Resource Metadata is the mechanism MCP agents use to discover authorization servers. Here's the full walkthrough of the spec, how AuthPlane implements it, and what it means for your MCP server.