#oauth

Two things would prevent most OAuth bugs. OAuth answers what a caller may access, not who they are, so using it to log people in is a category error. And the flow chart everyone agonised over has collapsed: authorization code plus PKCE, for every client type, no exceptions.

Most MCP tutorials stop at hello-world. Then you try to run one on the open internet with real auth, real load, and real attackers, and every assumption breaks. Here are the five design decisions that actually decide whether your server survives production.