Only 8% of OAuth-advertising MCP servers meet the July 2026 security spec

·1 views

A developer scanned the official MCP registry and found 2,967 servers that deliberately implemented OAuth, testing them against the 2026-07-28 authorization requirements. While legacy OAuth components scored above 92% compliance, two newly mandated features — RFC 9207 issuer identification and Client ID Metadata Documents — lagged far behind at just 19% and 23% respectively. Only 8% of the audited servers satisfied all requirements simultaneously. The failures are widely distributed across roughly 2,610 individual operators rather than concentrated among a few identity providers, meaning no single fix would resolve the gap. The author notes the 8% figure is a ceiling, not a floor, since the audit read only public metadata declarations and could not verify actual runtime behavior.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Two-Artifact Freeze Method Keeps AI Patch Reviews Scoped to Real Bugs

Open-source maintainers risk unintended API expansions when coding models generate overreaching diffs in response to bug reports. A proposed workflow requires freezing two artifacts before any model session begins: a git bisect SHA identifying the first bad commit, and a snapshot of existing public API names. These two files act as hard merge gates, restricting model edits strictly to files changed in the offending commit. The bisect must confirm a reproducible test failure before any chat session starts, and a flaky test halts the entire process. The method aims to prevent silent surface-area growth and keep code review focused on the actual defect rather than model-suggested additions.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI Agents Excel at Exploratory Testing but Fall Short for Regression Suites

AI agents have proven effective for exploratory testing by dynamically navigating interfaces, reacting to unexpected states, and investigating bugs without fully predefined steps. However, regression testing demands repeatable, documented action sequences and consistent checks so that results across multiple runs can be meaningfully compared. When an agent adaptively chooses alternate paths or accepts different signals as proof of success, it undermines the comparability that regression testing requires. Experts argue teams should use AI agents for ambiguous, one-off, or investigative tasks while investing in structured test assets for workflows that must be verified before every release. The key question for testing teams is not whether to use agents or automation, but which work benefits from flexibility and which requires repeatability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Postgres Advisory Locks Prevent Double-Counted Bids in Pay-to-Rank Apps

A developer behind Steal the Spot, a pay-to-rank leaderboard where every bid is real money, shared a concurrency-safe payment pattern built on Supabase Postgres and Dodo webhooks. The core problem addressed is duplicate webhook deliveries and simultaneous bids causing incorrect rankings or double-applied payments. The solution uses pg_advisory_xact_lock to serialize bids per season, an idempotency check that detects already-processed payment IDs, and a FOR UPDATE row lock to prevent interleaved rank calculations. The advisory lock's transaction-scoped variant ensures a crashed worker cannot permanently block the system. Access to the underlying database function is restricted to the service role, preventing clients from manipulating their own rank directly.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Learns Hard Lessons Adding Chinese to an AI-Powered Codenames Game

A developer who built an AI-powered Codenames web game added Simplified Chinese word sets after a reader requested multi-language support. AI tools generated candidate translations quickly, but evaluating whether they were natural or appropriately ambiguous still required human judgment. An automated validator that flagged substring overlaps as hard errors initially pushed translations toward unnatural single-character fragments and awkward abbreviations. Relaxing the rule so overlaps triggered review rather than build failures allowed more natural Chinese words to be used. The key insight was that automated validators can catch structural errors like duplicates, but product decisions about word meaning and naturalness require human oversight.

0 comments Read more at DEV Community