Model Context Protocol (MCP) je dnes jedním z nejrychleji rostoucích standardů pro integraci LLM modelů s nástroji a servery. Oficiální C# SDK právě dosáhlo stabilní verze 1.0 s plnou podporou specifikace 2025-11-25. Pojďme se podívat, co nového přináší.

https://zdrojak.cz/clanky/mcp-c-sdk-dosahlo-verze-1-0-co-prinasi-nova-specifikace/

Bindu Reddy (@bindureddy)

MCP가 신뢰성과 인증 문제로 한계에 부딪히고, 대신 OAuth와 API로 돌아가자는 논의가 나오고 있습니다. 3rd-party 시스템 연결과 작업 수행에서 LLM의 약점이 다시 강조된 업데이트입니다.

https://x.com/bindureddy/status/2038442206894416312

#mcp #oauth #api #llm #connectors

Bindu Reddy (@bindureddy) on X

RIP MCP! MCP is dying and we are back to using OAuth and APIs MCP servers are unreliable, very limited and don’t handle auth well Overall LLMs still struggle with connectors and operations on 3rd party systems

X (formerly Twitter)
OAuth account takeover doesn't need leaked tokens. No state param = CSRF to forced account linking. Loose redirect_uri matching = code theft via open redirect chains. Implicit flow puts tokens in browser history and Referer headers. PKCE bypass when not enforced server-side. SSRF via OpenID dynamic client registration. Six patterns, all with labs. https://www.kayssel.com/newsletter/issue-43/ #OAuth #BugBounty #Pentesting #websecurity #Offsec #InfoSec
OAuth 2.0: Six Ways the Authorization Flow Breaks

Missing state CSRF, redirect_uri hijacking, open redirect code theft, implicit flow token leakage, PKCE bypass, and SSRF via OpenID dynamic client registration

Kayssel

today, i set up emacs gnus as mail client for my work email at microsoft outlook. an administrator of our microsoft-tenant had to approve my client-id and -secret beforehand.

- emacs mail reader: gnus (with some custom elisp)
- sasl plugin kdexoauth2 for cyrus sasl method
- pizauth as oauth2 daemon
- msmtp for smtp
- isync / mbsync for imap

my custom elisp code ensures that pizauth server is running; opens the approval-URL in my browser; and asks me if i have clicked the button in the browser, before it fetches the emails.

as a final step, i'm going to set up mu as gnus search backend. just like i do for my personal emails on my personal computer.

#emacs #gnus #mail #email #outlook #microsoft #oauth #oauth2 #mbsync #isync #msmtp

⚠️ Device Code Phishing Hits 340+ Microsoft 365 Orgs Across Five Countries via OAuth Abuse

"Construction bid lures, landing page code generation, DocuSign impersonation, voicemail notifications, and abuse of Microsoft Forms pages are all hitting the same victim pool through the same https://Railway.com IP infrastructure."

https://thehackernews.com/2026/03/device-code-phishing-hits-340-microsoft.html

#microsoft365 #infosec #oauth

Railway

Railway is an infrastructure platform where you can provision infrastructure, develop with that infrastructure locally, and then deploy to the cloud.

Railway

Did you know you can add a free #OAuth login to your app using #ATProto (aka #Bluesky)? And you can store data in the user's account?

In my latest blog I go over the process in a client-side #ReactJS app and share ideas for apps you could make using this API.

https://whoisryosuke.com/blog/2026/free-auth-and-db-using-at-proto/

Free Auth and DB using AT Proto - Ryosuke

The blog and portfolio of Ryosuke Hana (Oscar Diaz)

Somehow I just implemented an #OAuth login method for the first time in my 5 years as a web developer. I'd only ever done email + password authentication before (and yes, with hashing, salting, and all the expected security measures). Well, I guess better late than never. Having a great experience with Better Auth so far!

#webdev #coding #React #JavaScript #TypeScript

RedmineのネイティブOAuth2でAIエージェントに安全にRedmineを操作させる - Qiita

TL; DR Redmine 6.1 のネイティブ OAuth2 + ゲートウェイで client_secret を集約し、CLI ツールがトークンを隠蔽することで、API キー不要・スコープ制限付き・AI コンテキストへのトークン漏洩なしで Redmine を操作させ...

Qiita

The IETF just published a framework for AI agent identity. AIMS composes SPIFFE, WIMSE, and OAuth 2.0 into an 8-layer model that replaces static API keys with proper workload identity. 53% of MCP servers still use API keys — this changes that.

https://iamdevbox.com/posts/ietf-aims-ai-agent-identity-management-system-spiffe-oauth/?utm_source=mastodon&utm_medium=social&utm_campaign=blog_post

#AIAgentSecurity #OAuth #SPIFFE #IAM #IdentitySecurity

Any fediverse developers with too much free time on their hands interested in helping me figure out why, when logging in with a Friendica account, I get an "Unprocessable Entity" error?

https://github.com/stefanbohacek/auth-server

#fediverse #oauth #friendica #fedidevs #nodejs #opensource