Letting users trust their own MCP clients, without opening a phishing hole
Comments
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Ranked by a public rubric, not by votes: what a comment adds counts, not who wrote it. How comments are ranked · Comment rules
Summary
Stream Vessel's Alexander Loginov describes a problem with MCP OAuth: self-registered clients need redirect URIs to work, but open registration lets attackers send authorization codes to their own servers via a one-click phishing link.