Redditor seeks MCP server operators to test per-agent tokens with 1-minute revocation
zach-benson · reddit · 2026-11-08
A Reddit developer building an open-source auth library is recruiting MCP server operators to pilot per-agent tokens on read endpoints. The pitch: each agent gets its own short-lived token (user in sub plus an agentid) signed by a verifiable issuer, so revoking one misbehaving agent takes effect in 1 minute without forcing the whole user to re-auth.
- Operators choose which tools accept the token; read endpoints only to start
- Setup: 30 minutes, a small snippet plus two settings (issuer URL and audience), observe-only — tokens are checked and logged but nothing is blocked
- Participants get per-agent visibility in logs ("agent X of user Y called search 40 times"), a one-agent kill switch, and a write-up including what didn't work
The author drafted the post with Claude's help and openly asks for feedback, including reasons people would decline.
More from coding & agent
- The software factory is the next extinct wrapper: coding agents will absorb orchestration value in 3-6 months — blaizedsouza · 2026-11-08
- CodeClimb's sandboxed architecture lets coding agents run overnight experiments without exposing credentials — blaizedsouza · 2026-11-08
- Indie dev burns 3 Codex reset cards and 64K AI-written lines to ship CapWise — vista8 · 2026-11-08
- A plain-language guide to LLM evals, explained through a customer-support assistant — blaizedsouza · 2026-11-08
- X402 MCP Template Lets AI Agents Pay for APIs via Gasless USDC Micropayments — modelcontextprotocol · 2026-11-08
- Shipbook Launches Verified MCP Connector for Session-Based Log Search — modelcontextprotocol · 2026-11-08