Identity security blog
SHORT ANSWER
Analysis, explainers and buyer checklists written from the standards and vendor material cited across this site. Every post is dated and lists its sources.
Editorial assessment · Desk research from public vendor material · Reviewed 2026-09-29
2026-08-18
- MCP
- Buying
How to run a proof of concept for an MCP gateway
Run an MCP gateway proof of concept against the MCP specification's own security rules. Pick three real workflows, write the policies first, then try the failures the specification lists and check that each one is stopped and logged.
4 min read
2026-07-28
- MCP
- Standards
Reading the 2025-11-25 MCP authorization specification: what buyers should check
The MCP authorization specification dated 2025-11-25 keeps the core model of the 2025-06-18 version, OAuth 2.1 with tokens bound to one MCP server, and states several requirements buyers can check directly: PKCE with S256, refresh token rotation for public clients and a 403 step-up response when a scope is missing. Our scores are based on the 2025-06-18 text.
4 min read