MCP server operators on agent identity: per-IP rate limits break, accounts are the real gate
zach-benson · reddit · 2026-11-07
A Reddit operator survey distills how MCP server maintainers handle agent identity and rate limits:
- Per-IP limits break for agents: shared egress (serverless, corporate NATs) lets one recursive script drain everyone's quota, and some providers return 403s on IP reputation well before any 429.
- Anything costing money needs an account: OAuth sign-in, user-bound keys, or credits — no-signup IDs can't ration anything since fresh ones are free for abusers.
- Real abuse is account farming, not loops: fixes that worked made new accounts costly — verified domains, paid plans, tight first-hour limits.
- Orphaned tokens: boring but effective fixes — owner on every key, last-used timestamps, auto-revoke after 30 idle days.
- OAuth's real cost is client quirks: ignored resource parameters, audience validation, uninformative handshake errors.
One operator proposes a rule worth testing: a signed client label (proving which integration is calling) could earn looser ceilings on cheap cached reads, while anything costing money still requires an account. The author is building an open-source library in this space.
Related event: MCP Server Operators Find IP-Based Rate Limiting Useless Against Agents(2 posts)→
More from coding & agent
- Building an incident-response agent: why memory alone can't be trusted for operational warnings — noufal_rizwan · 2026-11-07
- Letting AI stay on the line after customers hang up turned post-call notes into actions — gsuiteautomations · 2026-11-07
- Tsinghua's Coca-Cola compresses agent tool outputs, cutting tokens up to 89% while boosting accuracy — Tsinghua · 2026-11-07
- ComfyUI-freefield puts Freefield's 117 workflows in a sidebar with one-click model downloads — neuregex · 2026-11-07
- How do you stop micromanaging a custom agent harness? A Reddit dev's research-task dilemma — dangerous_inference · 2026-11-07
- Engineering agency founder's 10-year lessons: small teams ship, turn down 30% of clients — alex_verem · 2026-11-07