MCP over HTTP exposes OAuth audience validation flaw

Running MCP servers over HTTP with OAuth requires validating the token's audience claim, not just token validity. A researcher released an open-source AI agent security audit kit covering 35 controls highlighting this common flaw.

2026-11-05 ~ 2026-11-05 · 2 related posts

• MCP over HTTP: validating OAuth tokens isn't enough—check the audience claim — alvelda · 2026-11-05
• Agent Security Audit Kit: 35 controls for auditing AI agents, plus an MCP OAuth audience-claim pitfall — alvelda · 2026-11-05