Kozou Adopts OAuth Resource-Server Model for Remote MCP Without Issuing Tokens

·1 views

Kozou, an open-source tool that exposes PostgreSQL context to AI agents via MCP and REST, added remote MCP support with OAuth authentication in version 1.13.0, released on July 13, 2026. Rather than building its own authorization server, Kozou was designed as an OAuth resource server that validates tokens issued by third-party providers and enforces access accordingly. The approach maps incoming JWT claims to PostgreSQL roles using SET LOCAL ROLE, then relies on Postgres row-level security to handle data enforcement. This resource-server posture was not adopted to comply with the MCP authorization spec; it had already been implemented on the REST surface in v0.2.0 on June 1, 2026, and simply extended to the MCP transport. By holding no credentials or user accounts, Kozou avoids the security risks associated with managing an identity store.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Namecheap Auctions Close in a Daily Batch, Not by Individual Timer

Unlike eBay-style bidding, all Namecheap expiring and marketplace auctions close simultaneously at 11:00 AM ET each day, making last-second sniping ineffective. Any bid placed near the closing window triggers an automatic extension, so speed alone cannot win an auction. A developer has built a tool called PounceDomains around this mechanic, focusing instead on early discovery and accurate valuation. The platform scans Namecheap's aftermarket continuously, lets users describe desired domains in plain English, and applies seven scoring filters before an AI ranks surviving results. It also surfaces Namecheap's largely overlooked Closeout listings — expired auctions re-listed at steeply reduced prices — sorting them by authority, backlinks, search demand, and age.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GrapheneOS 2027 Expands Official Support to Motorola, OnePlus, and Sony Flagships

GrapheneOS announced official support for select flagship phones from Motorola, OnePlus, and Sony in early 2027, marking the first time the privacy-focused Android fork has been available on high-performance devices beyond Google Pixel. The supported models — including the Motorola Edge 30 Ultra, OnePlus 12 Pro, and Sony Xperia 1 V — all feature Snapdragon 8 Gen 3 processors and meet GrapheneOS's hardware security requirements. Compared to stock Android, GrapheneOS 2027 replaces Google Play Services with a sandboxed compatibility layer, enforces mandatory verified boot, and applies a hardened network stack with DNS-over-HTTPS. The release drew significant attention online, with searches for 'GrapheneOS Motorola' spiking 250% on Google Trends within days of the announcement. Monthly over-the-air updates with signed binaries and a three-year support window are included for all newly supported devices.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GSoC Contributor Passes Midterm, Hardens sbi Builder API in Weeks 7–8

A Google Summer of Code (GSoC) contributor passed their midterm evaluation after completing weeks 7 and 8 of the program. The work focused on strengthening existing code rather than adding new features, primarily through pull request #1920, which introduced the RatioEstimatorBuilder for the NRE model family. Key improvements included immediate error-raising for invalid config values, rejection of model-incompatible keyword arguments at construction time, and making config dataclasses immutable to prevent silent misuse. The contributor also renamed ambiguous API parameters — z_score_x and z_score_y — to the clearer z_score_input and z_score_condition before the API shipped in any release, avoiding a future breaking change. For the second half of GSoC, the workflow has shifted: the contributor will now draft design proposals for mentor review before implementation begins.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Key dig Commands DevOps Engineers Need for Fast DNS Troubleshooting

DNS resolution failures are behind a significant portion of application outages, often mistaken for broken services. The command-line tool dig allows engineers to quickly trace where in the resolution chain a failure occurs, from the client's resolver to the authoritative DNS server. Common culprits include stale cached records, incorrect resolver configuration, and mismatched CNAME entries. Engineers are advised to always run diagnostics from the same host and resolver that the affected application uses, since testing from a local machine can produce misleading results. Key dig options such as +short, +trace, -x, and resolvectl status help isolate whether the issue lies in caching, delegation, or resolver misconfiguration.

0 comments Read more at DEV Community