Deep-dive guides on AI agents, agent orchestration, MCP, and developer tooling.
2 posts found
MCP started as a trusted local subprocess with no auth story at all. Its authorization spec bolts on OAuth 2.1, PKCE, and resource indicators — here is what each piece actually prevents, including the token-passthrough bug that keeps showing up in early implementations.
Rotating a JWT signing key is a distributed cache-invalidation problem wearing a cryptography costume — here is the four-stage timeline, the kid collision that breaks it silently, and why your overlap window is set by your slowest verifier cache, not your token TTL.