From-scratch PHP MCP server and OAuth2 notes
elixon · reddit · 2026-07-20
A developer built a minimal MCP server in PHP from scratch and shared the security tradeoffs they ran into.
- The implementation is a non-streamable HTTP MCP server for a self-hosted service, written from scratch in PHP.
- They also implemented OAuth2 from scratch without dependencies, and say it works for them so far.
- They considered adding Dynamic Client Registration (DCR) but concluded it does not meaningfully improve security for open MCP servers where client count and type are uncontrollable.
- The main unresolved question is how to build a practical redirecturi whitelist for OAuth, since real client targets vary across localhost URLs, app IDs, and platform-specific URI schemes.
- The post is framed as a “fun” learning project, but the technical discussion is about minimal secure MCP deployment.
More from coding & agent
- Devin adds e2b sandboxes for remote agent execution — badphilosopher · 2026-07-22
- Hermes Agent Refactoring Proposal: Decoupling via Event Bus and Monorepo Slicing — Promptmethus · 2026-07-22
- ty now reads Pydantic config keywords and field metadata — charliermarsh · 2026-07-22
- Pensar Launches AI Security Agent to Autonomously Discover and Patch 0-Days — andriy_mulyar · 2026-07-22
- ty adds first-class Pydantic support, including strict and lax field handling — charliermarsh · 2026-07-22
- Google launches Gemini 3.5 Flash Cyber for CodeMender, with limited access for governments — GoogleAI · 2026-07-22