Sourced / Security blog
AI & MCP Permissions
Website, API and AI security. Clear scope, useful evidence, and practical fixes.
30 articles / Page 2 of 2
- AI & MCP Permissions
Treat Repository Instructions as Data
Read customer repository instructions as untrusted evidence, not worker policy, and test the boundary in an owned lab.
- AI & MCP Permissions
Validate AI Tool Result Schemas
Parse AI tool responses into bounded approved fields and reject malformed, oversized, or unexpected output.
- AI & MCP Permissions
Validate MCP Localhost Redirects
Review desktop OAuth loopback callbacks for exact host and path matching, port binding, state, and one-time use.
- AI & MCP Permissions
Validate MCP Token Audience
Reject an MCP access token issued for another resource, even when its issuer and lifetime are valid.
- AI & MCP Permissions
Verify Agent Approval Records
Bind each human approval to one exact agent action, caller, tenant, input digest, and expiry.
- AI & MCP Permissions
Verify MCP Authorization Issuers
Check issuer identity during MCP OAuth discovery and code exchange to prevent authorization-server mix-up.