MCP Token Audience Check: expectedResource Tested (2026)
October 6, 2026
I tested the MCP TypeScript SDK's new expectedResource option for token audience validation. It is off by default and Express adapter 2.0.1 ignores it (2026).
#oauth
MCP Goes Stateless: The 2026-07-28 Spec Explained
July 14, 2026
MCP's July 28, 2026 spec goes stateless and ships Enterprise-Managed Authorization. Here's what changes, what breaks, and new security risks to plan for.
MCP Server in TypeScript: OAuth 2.1 + Streamable HTTP (2026)
May 14, 2026
Build a production MCP server in TypeScript with OAuth 2.1, RFC 8707 resource indicators, Streamable HTTP, and scope-aware tool authorization in 2026.
OAuth Explained: Secure, Reliable Auth
Updated: March 27, 2026
OAuth 2.0 + OpenID Connect for real apps: authorization code flow with PKCE, refresh tokens, scopes, and the common traps that ship to production.