Blueprint outlines four security controls for hosted multi-tenant MCP servers

·2 views

A follow-up to the Shelf Watch series presents an Enterprise MCP Reference Blueprint of four controls for multi-tenant MCP servers, aimed at teams without large budgets. The first control is OAuth 2.1 with PKCE tied to existing role-based scopes, so agents never exceed their operator's access. The second is per-token rate limiting and single-subject write tools to bound the damage a misbehaving agent can cause. The article also notes a 2026 update reporting a static audit of 300 MCP servers, with 10 found to have verified code-level vulnerabilities, and a fix for a device-code HTTPS issue in mcp-remote v0.16.6.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Arm CEO Rene Haas Reportedly Approached About Nvidia CEO Role

Rene Haas, the chief executive of chip designer Arm, has reportedly been approached as a candidate to lead Nvidia. The Financial Times article linked in the source suggests Nvidia is considering external options for its top job. The source provides only a link and minimal metadata, so details such as who initiated the approach and the timing are not confirmed. Arm and Nvidia are both major players in the semiconductor industry, which makes the report notable. No official statement from either company is included in the available material.

0 comments Read more at Hacker News

ProgrammingHacker News ·

LibreOffice Highlights Year-Round Availability in Social Media Post

The LibreOffice account posted a message on Twitter noting that the office suite is available every day of the year. The post was shared on Hacker News, where it gathered 13 points. No comments had been posted on the discussion thread at the time of the snippet. The item offers little beyond the social media message itself, with no additional details about new features or announcements. The source material is limited, so the summary cannot elaborate further on context or significance.

0 comments Read more at Hacker News

ProgrammingHacker News ·

FBI says North Korean hackers used fake video calls in $400M crypto heist

The FBI has attributed a cryptocurrency theft worth about $400 million to North Korean hackers. According to the agency, the attackers used fake video calls to deceive their targets. The details are drawn from a BBC report linked in the original post. The source material provided is limited, so further specifics about the victims and timing could not be confirmed here.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Zoho CRM subforms or related modules: choosing the right structure for child records

A subform is an in-record table for line items, suited to small, fixed-shape lists like order lines. When child data needs independent searching, filtering, workflows or ownership, Zoho's documentation indicates subforms are a poor fit because many features do not reach their fields. Limits on columns, rows and availability vary by edition, and Zoho's own pages disagree on which plans support custom subforms. Subform fields also miss out on imports, lead and quote conversion, and API updates, though they can feed reports and aggregate totals on the parent. Users are advised to confirm their edition's feature availability before designing around subforms.

0 comments Read more at DEV Community