Hey folks — I’m Ravi, a 2× founder and currently building Scalekit. Before this, I led platform and auth infrastructure at Freshworks.
Been neck-deep in auth, identity, and security for more than a decade now.
We’re seeing more and more MCP servers being spun up to expose tools and workflows to AI agents. But honestly most of them are still unauthenticated or worse, they reuse agent tokens across systems.
This is clearly a problem because the March 2025 updated the MCP spec to now formally mandates OAuth 2.1 as the auth standard for MCP servers.
Also, as Aaron Parecki, Director of Identity Standards at Okta mentioned: “Just treat every MCP client as an OAuth client. Treat the MCP server as a resource server that uses an existing authorization server. That’s it. Problem solved.”
That's exactly what we did to help you separate the authz layer from your business logic - a drop-in OAuth 2.1 module for MCP servers. It handles:
- Scoped, short-lived tokens
- DCR + PKCE + metadata discovery
- 401s with authorize_url for delegated 3P workflows.
Would love to hear your feedback if you’re building with agents or your MCP servers.
ravimadabhushi•18h ago
Been neck-deep in auth, identity, and security for more than a decade now.
We’re seeing more and more MCP servers being spun up to expose tools and workflows to AI agents. But honestly most of them are still unauthenticated or worse, they reuse agent tokens across systems.
This is clearly a problem because the March 2025 updated the MCP spec to now formally mandates OAuth 2.1 as the auth standard for MCP servers.
Also, as Aaron Parecki, Director of Identity Standards at Okta mentioned: “Just treat every MCP client as an OAuth client. Treat the MCP server as a resource server that uses an existing authorization server. That’s it. Problem solved.”
That's exactly what we did to help you separate the authz layer from your business logic - a drop-in OAuth 2.1 module for MCP servers. It handles: - Scoped, short-lived tokens - DCR + PKCE + metadata discovery - 401s with authorize_url for delegated 3P workflows.
Would love to hear your feedback if you’re building with agents or your MCP servers.