Open DCR on remote MCP servers invites auth-code hijacking: should you allowlist redirect URIs?
After_Pumpkin3803 · reddit · 2026-11-07
A developer running a remote MCP server with OAuth Dynamic Client Registration outlines a real attack vector: with open DCR, anyone can register a client named "Claude" or "ChatGPT" and set the redirecturi to a domain they control, then send customers a legitimate-looking authorization link. When the customer approves the consent screen, the auth code goes to the attacker, who exchanges it for a token and makes MCP tool calls as that customer.
The author asks how production deployments handle this: allowlist redirect URIs, warn, or leave it open — and whether localhost or custom-scheme redirects for desktop clients introduce extra pitfalls. The post lays out a clear attack chain; community answers are where the operational guidance lives.
More from coding & agent
- Copilot CLI v1.0.108-1 fixes Grok PDF attachments and sandbox MCP path handling — copilot-cli-release-app[bot] · 2026-11-07
- Building an incident-response agent: why memory alone can't be trusted for operational warnings — noufal_rizwan · 2026-11-07
- Letting AI stay on the line after customers hang up turned post-call notes into actions — gsuiteautomations · 2026-11-07
- Tsinghua's Coca-Cola compresses agent tool outputs, cutting tokens up to 89% while boosting accuracy — Tsinghua · 2026-11-07
- ComfyUI-freefield puts Freefield's 117 workflows in a sidebar with one-click model downloads — neuregex · 2026-11-07
- How do you stop micromanaging a custom agent harness? A Reddit dev's research-task dilemma — dangerous_inference · 2026-11-07