MCP OAuth Confirms Identity But Cannot Authorize Individual Tool Calls

·9 views

The 2026-07-28 MCP specification strengthens authentication through issuer validation, CIMD direction, and Mcp-Method/Mcp-Name headers, but these advances address only identity verification. Authentication (AuthN) confirms who is making a request, while tool-call authorization is a separate decision determining whether that principal may execute a specific tool in a given context. Risk levels vary significantly across operations — a read action carries far less risk than a financial transaction or a destructive database command. A recommended architecture routes requests through an MCP client, gateway, and Policy Decision Point (PDP) before reaching the MCP server, with deny-by-default rules and step-up checks applied to high-risk operations.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How JWT Tokens Carry Identity and Permissions Across Microservices

In microservice architectures, every request requires context about who is making it and what they are allowed to do, which is handled through JWT access tokens created at login. A User Profiles Service issues these tokens via two endpoints — one returning a full login response and another returning only a Bearer token for callers that already have user context. Before generating a token, the service verifies the user's password, resolves their relationships to projects, accounts, and organizations, and retrieves permissions from a dedicated permissions service. The resulting JWT payload contains not just a user ID but a full security context including project, account, organization, group, and per-service permission mappings. This graph-like linking model ensures that authorization decisions across services are based on verified, structured context rather than raw request headers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Dev.to's Underused API Can Reconstruct Your Full Follower History in One Pull

A developer who has been publishing on Dev.to since April 2017 used the platform's largely overlooked public API to analyse nine years of their own writing and audience data. By querying the followers endpoint with the correct v1 accept header and a per_page value of 1000, they reduced a 227-request operation to just 19 calls. A key discovery was that each follower record includes a created_at timestamp, allowing the entire follower growth curve to be reconstructed retroactively from a single API pull rather than daily snapshots. However, the dataset only reflects current followers, meaning anyone who unfollowed is absent and the resulting curve rises monotonically, masking any real-world declines. The author notes that omitting the v1 accept header silently returns older v0 data with no error, a subtle gotcha that can cause documented fields to appear missing.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build Production-Grade Mobile Apps With Failure-First Architecture

A technical guide published on DEV Community outlines a failure-first approach to designing production-grade mobile applications, arguing that real engineering complexity lies beneath seemingly simple user interactions. The guide emphasizes defining clear system boundaries and layer ownership — separating presentation, domain, and data concerns — rather than starting with a list of screens. It warns against representing UI state with unrelated booleans, which can produce impossible combinations, and instead recommends sealed state interfaces to model meaningful transitions explicitly. The principles discussed are framework-neutral but are said to apply well to Kotlin/Android, Swift/iOS, Flutter, and React Native. The article also addresses offline-first behavior, network failure handling, and recovery strategies as essential considerations for scalable mobile codebases.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Freelance Developers Can Use Milestone Payments to Avoid Disputes

Freelance software developers often face late or withheld payments due to poorly defined project structures rather than bad-faith clients. Structuring projects into clearly defined milestones — such as spec, core build, completion, and handover — with explicit deliverables and acceptance criteria can prevent most payment conflicts. Each milestone should specify which features must work, which tests must pass, and include a fixed client review window, after which silence is treated as approval. Escrow arrangements, where clients fund each milestone before work begins and funds are released upon approval, add a neutral safeguard for both parties. Keeping the final milestone at 20% or less of the total budget and treating all out-of-scope requests as separately priced milestones further reduces financial risk for developers.

0 comments Read more at DEV Community