Anarlog Ships Remote MCP With OAuth 2.1 Resource-Bound Tokens to Block Replay
beerbellyman4vr · reddit · 2026-09-17
The founder of Anarlog, an MIT-licensed local-first Rust/Tauri meeting notetaker, details shipping a remote MCP server (Streamable HTTP) exposing 5 read-only tools for Claude, Cursor, Copilot, and ChatGPT. Auth uses dynamic client registration + PKCE via Supabase, with OAuth 2.1 tokens bound to the MCP resource URL so tokens leaked from other MCP servers can't be replayed. The bigger pain was payload size: 2MB snapshots force stripping word-level transcript timing first.
More from coding & agent
- Routing simple requests to a cheap model made our total LLM bill worse — Massive_Tell_4276 · 2026-09-17
- Dev loves Codex app's /side chat so much he bound it to ⌘S — alex_frantic · 2026-09-17
- From personal second brain to team brain: one table, labels, and MCP access — Cole Medin · 2026-09-17
- AI SDK Adds evaluate Method, Welcomes Typesafe AI's New Jev Model — cramforce · 2026-09-17
- BotBell MCP lets AI assistants push notifications to iPhone and Mac — modelcontextprotocol · 2026-09-17
- Hüttentouren MCP adds live hut-to-hut hiking availability in the Alps — modelcontextprotocol · 2026-09-17