Tag: MCP

Model Context Protocol architecture and security: STDIO and HTTP transports, OAuth 2.0 authorization for remote servers, protected resource metadata, and the stateless redesign.

• Going Stateless Was the Right Call for MCP, but with a Cost

  25 Sep, 2026

  • 14 min read

  MCP is now stateless. Here's why that's the right call, what actually replaces the old session handshake, and why state didn't disappear

• Browser-Based Agents Are Impersonating You: The Agent Identity Problem

  2 May, 2026

  • 23 min read

  Browser-based agents inherit your session, your cookies, and your identity, with no distinction visible to the service provider. Here's why that's a problem we've already solved once, and what needs to happen next.

• Unwrapping MCP Security: A Walkthrough with the PayPal MCP Server

  12 May, 2025

  • 12 min read

  A walkthrough of connecting Claude Desktop to PayPal’s remote MCP server over HTTP, highlighting the full OAuth 2.0 flow with Postman from discovery to authorization

• Unwrapping MCP: A Walkthrough with the GitHub MCP Server

  7 May, 2025

  • 11 min read

  MCP explained from the inside out, starting with a real developer workflow then unwrapping the protocol layer by layer: roles, messages, connection lifecycle, and STDIO transport.

• Protected Resource Metadata Is the Missing Piece in OAuth 2.0 Discovery

  4 May, 2025

  • 9 min read

  OAuth 2.0 could automate client registration and AS discovery, but clients still had to hardcode which authorization server protects a given resource. Protected Resource Metadata fixes that. Here's how PRM completes the dynamic integration story, and why AI agents made it urgent.