The auth section is the part most teams will skip, so one addition from the other side of the layer. Once it sits in front of vendor MCP servers, the layer is also the OAuth client for each of them, and the client checks matter too. We checked 61 official SaaS MCP servers on Nov 4: all 61 returned a 401 and supported PKCE, but 40 did not advertise the RFC 9207 issuer check. A layer that talks to several authorization servers is exactly the setup mix-up attacks target, so it should verify iss on every callback instead of trusting whichever server answers. It is also the natural place to pin the vendor tool lists you describe, since a vendor can change a description after you approved it.
X1Y1
AI features that work in production. RAG, agents, MCP, cloud and security for startups.
The auth section is the part most teams will skip, so one addition from the other side of the layer. Once it sits in front of vendor MCP servers, the layer is also the OAuth client for each of them, and the client checks matter too. We checked 61 official SaaS MCP servers on Nov 4: all 61 returned a 401 and supported PKCE, but 40 did not advertise the RFC 9207 issuer check. A layer that talks to several authorization servers is exactly the setup mix-up attacks target, so it should verify iss on every callback instead of trusting whichever server answers. It is also the natural place to pin the vendor tool lists you describe, since a vendor can change a description after you approved it.