Three Major Pitfalls of Remote MCP Servers
Objective_Speed_5885 · reddit · 2026-07-18
The author summarizes three key pitfalls encountered when building a remote MCP server:
- Remote services must use OAuth 2.1: The server doesn't issue tokens but validates tokens issued by an external authorization server, using protected-resource metadata to tell the client where to authenticate.
- stdout cannot be misused under stdio: Any console.log can break the protocol stream; logs must be written to stderr.
- Tools should be as "thin" as possible: Splitting a large, catch-all managenotes(action, ...) into multiple narrow tools and adding clear constraints to each field significantly improves model selection and reduces parameter hallucinations.
The author also turned the whole setup into a reusable template: including an OAuth verifier (JWKS + RFC 7662), two transport types, session management, a demo AS, Docker/Fly configurations, and 42 tests covering the entire flow from registration to PKCE and MCP calls.
More from coding & agent
- A better path to agent autonomy is running waves, finding friction, and iterating — JnBrymn · 2026-07-22
- Coding agents are heading toward an AI-writes, AI-reviews, human-approves workflow — aftahi_ai · 2026-07-22
- oMLX 0.5.2 adds Mac menu-bar stats, low-bit decode kernels, and faster downloads — awnihannun · 2026-07-22
- GitHub review bot hits its PR limit and forces a 39-minute cooldown — DanielLockyer · 2026-07-22
- Max reasoning effort appears to be mobile-only in Codex Remote, not desktop — GabGarrett · 2026-07-22
- A Reddit demo argues online stores should expose carts and pricing through MCP — gelembjuk · 2026-07-22