Agent-to-agent and agent-client standards beyond MCP: A2A, ACP.
Using long-lived, broadly scoped API keys in configuration files creates massive security vulnerabilities as agent deployments scale. If thousands of agents run with broad access keys, a single compromise exposes all connected systems. We must transition away from these static secrets to dynamic access models.
▶ 1:09
How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
The creators developed MCP internally at Anthropic out of frustration with siloed development tools like cloud desktop and IDEs. They borrowed architectural patterns and bi-directional communication from the Language Server Protocol to solve the M times N integration problem.
▶ 3:55
The Creators of Model Context Protocol
The authorization code flow mediates requests between a client application and a resource server via an authorization server. The authorization server authenticates the user, obtains consent, and issues an access token to the client. This token is then used to access protected resources while supporting short-lived, rotated refresh tokens.
▶ 2:18
How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
The creators designed separate primitives to give application developers specific UI affordances and control over how features manifest. While tool calling is model-driven, resources and prompts allow for user-initiated data pulling and application-controlled workflows that better fit different user experiences.
▶ 9:59
The Creators of Model Context Protocol
The initial version of MCP featured no authorization mechanisms at all, prioritizing rapid prototyping primarily for local servers. While it sparked ecosystem interest, it left remote and connected servers entirely unprotected. This required developers to look toward formal authorization protocol drafts.
▶ 7:01
How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
Tool results should not be over-specified into rigid structured JSON schemas to ensure they scale as LLMs improve. Instead, servers should return raw text, images, or messages directly passed through from the underlying API. This lets the LLM sort through the data and extract what it needs, leveraging its natural strengths.
▶ 25:50
The Creators of Model Context Protocol
The late March draft erroneously forced MCP servers to implement all of OAuth 2, including token issuance and authentication. This collapsed the authorization server role directly into the resource server, violating core OAuth principles and causing widespread industry criticism.
▶ 8:03
How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
OpenAPI specifications are too granular and fail to express higher-level, AI-specific concepts needed for rich LLM interactions. MCP provides purpose-built primitives like tools, resources, and prompts that models benefit from more than a raw REST API. Additionally, MCP supports stateful interactions which are increasingly important for modern multimodal AI apps.
▶ 29:59
The Creators of Model Context Protocol
MCP servers should act strictly as OAuth resource servers rather than handling their own token issuance. The authorization server must remain a completely separate entity that handles authentication and issues tokens. This simplifies the MCP server's job to simply verifying incoming HTTP tokens.
▶ 9:08
How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
You should pick your preferred language and its SDK, then build a simple tool for something that matters to you personally. Avoid overthinking the descriptions initially and use standard IO protocol transport to test it in an application. You can even feed the SDK code and MCP spec to an LLM to generate the server for you in about half an hour.
▶ 33:34
The Creators of Model Context Protocol
While the authorization code flow handles end-user delegation, the client credentials flow applies when agents communicate autonomously. Agents use this flow to interact with other agents or MCP servers on their own behalf rather than acting for a logged-in user.
▶ 11:03
How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
Yes, MCP servers can simultaneously act as MCP clients to create recursive compositions and rich workflows. This allows developers to chain servers together into directed acyclic graphs where an MCP server can utilize the broader ecosystem of other servers. Such patterns enable modular architectures, though the SDKs still need minor niceties to make execution simpler.
▶ 41:42
The Creators of Model Context Protocol
Dynamic client registration allows agents to request credentials at runtime without prior manual registration. However, because the registration request itself is uncredentialed, it leaves all agents effectively anonymous. This makes building trust and tracking identity across agent ecosystems extremely difficult.
▶ 12:08
How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
The protocol uses OAuth 2.1 for user-to-server authorization, which avoids requiring users to manually paste API keys. This approach fits well into remote server architectures while keeping the specification minimal and extensible.
▶ 1:04:23
The Creators of Model Context Protocol
Instead of dynamic registration, we can use standard URLs as client identities in OAuth flows. By leveraging public key infrastructure (PKI) and key sets, agents can sign assertions or HTTP messages. Receiving servers then use corresponding public keys to cryptographically authenticate the agent.
▶ 13:27
How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
While the team believes future AI applications will be stateful, requiring a long-lived persistent SSE connection creates significant operational complexity at scale. The new streamable HTTP transport combines standard HTTP requests with optional streaming and session resumption to balance statefulness and operational scalability.
▶ 1:02:52
The Creators of Model Context Protocol
Traditional OAuth scopes are often too coarse-grained and long-lived for advanced AI agent operations. Transactional authorization allows agents to obtain permissions on a per-transaction basis, such as approving specific financial budgets or transaction amounts. Specifications like rich authorization requests provide a model for this dynamic requirement.
▶ 15:15
How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
Governance is strictly merit-driven, meaning contributors must submit practical work and SDK contributions rather than just opinions to gain commit access. The maintainers prioritize moving fast and avoiding slow standardization bodies over traditional foundation-heavy governance models.
▶ 1:10:30
The Creators of Model Context Protocol
When an MCP server calls another internal API or third-party service, basic OAuth connections are no longer sufficient. Developers should implement techniques like OAuth token exchange and identity assertion grants for cross-domain identity chaining. This preserves security visibility across complex multi-agent communication graphs.
▶ 16:24
How to Secure Agents using OAuth — Jared Hanson (Keycard, Passport.js)
The creators view centralized registries as brittle because social proof and download counts do not prevent supply chain compromises in updated packages. Instead of building a heavily vetted app store, they encourage developers to use the MCP inspector tool to examine traffic and verify security.
▶ 53:26
The Creators of Model Context Protocol
No answer mentions that.