v1.1.1MCP Server
•1 min read

MCP Server Security Hardening & RFC Compliance

MCPSecurityOAuth 2.1

Hardened OAuth 2.1 scope isolation across REST endpoints, added strict redirect URI validation in Dynamic Client Registration (RFC 7591), and added standard CORS preflights and RFC 6749 Cache-Control headers.

#MCP Server Security Hardening & RFC Compliance

We've deployed key security hardening updates and RFC compliance improvements across our Model Context Protocol (MCP) server and OAuth 2.1 authorization layer:

  • Strict Scope Isolation: Enforced complete token isolation between MCP scoped tokens and general REST APIs, guaranteeing that restricted MCP access tokens (e.g. keys:read) cannot access administrative REST endpoints.
  • Dynamic Client Registration Hardening: Implemented strict validation for redirect URI schemes in Dynamic Client Registration (RFC 7591), allowing https:, loopback http:, and verified native application schemes while rejecting script pseudo-protocols (javascript:, data:) and fragment identifiers.
  • Constant-Time PKCE S256: Upgraded PKCE code challenge verification to use constant-time cryptographic buffer comparisons.
  • CORS & Header Compliance: Added Cache-Control: no-store and Pragma: no-cache on OAuth token endpoints, and configured CORS preflight (OPTIONS) handlers across /mcp, /oauth/token, /oauth/register, and metadata discovery endpoints.