[1] https://doc.akka.io/libraries/akka-core/current/typed/actors...
"MCP authorization today is built around a person approving access in a browser. That works well for interactive clients, but more and more of the callers are agents running as cloud workloads with their own identity, acting on behalf of a user who isn’t present, or delegating narrower authority to sub-agents. We want MCP servers to have a standardized way to recognize and trust those agent identities, built on existing standards rather than pasted API keys and long-lived tokens.
The work here covers finalizing Demonstrating Proof of Possession (DPoP) and driving its adoption, and defining an opinionated path for agent identity and delegation through Workload Identity Federation, the ID-JAG grant behind Enterprise-Managed Authorization, and standard token exchange. We will also continue to grow our engagement with the OAuth standards bodies, including the IETF OAuth and WIMSE working groups, to help the underlying standards evolve with the building blocks that agent identity needs."
Good. Introducing a bespoke new protocol was one of the more bone-headed things MCP did on initial release.
I probably build more novel AI software than anyone at FAANG (can the employees who weren’t laid off even code anymore?) and never needed this hype.
Why do people think they need this
Senior programmers always advised me to only use things that have been around for at least three years. Now I finally understand why.
skinfaxi•28m ago
Kind of late to the party. I've had to implement lazy loading of mcps in a couple of harnesses now but am moving to implement everything as code mode instead.
rixed•27m ago
skinfaxi•18m ago
I was getting fed up with AWS mcp telling me it is eol.