Engineering notes
Articles for people who
ship the stack
Rewrites on React, Node.js, TypeScript and AI. A translated body is shown when it exists. If it does not, you see the English text and a note that says so.
Tagged: identity
MCP and OAuth2: Who Authorized the Agent's Action on Your MCP Server?
OAuth2 covers only part of agent authorization in the Model Context Protocol. How OIDC, scopes, confused-deputy rules, GNAP and capabilities fit together.
12 min readThe Agent Escape That Started With Loose Credentials, Not a Zero-Day
An eval agent escaped using one zero-day and a pile of leaked secrets. Why static keys are riskier for AI agents, what shipped for agent identity, six steps.
7 min readA Dual OAuth Boundary for MCP Gateways: Keeping the User's Identity
MCP gateways shouldn't squash every call into one service account. Inbound validation plus an on-behalf-of OAuth exchange keeps each user's identity intact.
11 min read
FAQ
About these articles
Yes. Each piece is an original English rewrite prepared for this site. Structure and code examples follow the source material; prose is rewritten and checked for overlap before export.
English is the source. Another language is shown only when that translation body exists. A missing or empty translation stays in English, including on a localized URL.
New drafts land in the publish queue as they pass editorial checks. Running the site import picks up only new or changed slugs — nothing is duplicated.
Treat samples as illustrative. Validate against your stack and licences before production use. For delivery work, contact us with the brief.
Request a 24h estimate
Need the same stack in a production operator layer? Send the brief — estimate within 24 hours.