Should MCP server operators trust agent identities issued by a third-party service?

zach-benson · reddit · 2026-11-07

A developer building an open-source library in this space surveys MCP server operators: would you treat an agent differently from anonymous traffic if its key were issued under a verified user account at a separate service — one key per agent, individually revocable, without you running the signup?

Context: operators note that anything costing money sits behind your own accounts, and free self-made agent IDs are worthless since abusers just create another. Options offered: A) must be an account on my own service; B) higher limits on free/cheap tools only; C) allow paid tools too; D) depends. Author discloses his bias, shares no link.

Original post →

More from coding & agent

coding & agent channel →