Topic · 6 stories
6 stories tagged oauth on AI Tamer, newest first.
The official MCP debugging tool published nine security advisories on 21 October. Two critical bugs let a remote MCP server run local commands. Fixes are out.
Proof Key for Code Exchange ties an authorization code to a secret the client created. Following that secret through the flow shows why a stolen code is insufficient.
A browserless CLI can ask you to approve access in another browser. The code on your screen identifies the pending session, so check which client you are approving.
Cloudflare's 1 October 2026 changelog says workers-oauth-provider v1 can run token issuing and an MCP resource server in separate Workers, with MCP's July 2026 client-metadata flow. npm shows 1.0.0 on 24 September.
MCP resource indicators name the server a token is for. Audience checks and separate upstream tokens keep that boundary intact.
Zyte (Sep 30, 2026) launches a hosted MCP server at mcp.zyte.com for Zyte API and Scrapy Cloud in Claude Code, Cursor, Codex, Copilot, and VS Code, with OAuth short-lived tokens, clean Markdown, and Scrapy job control.
