AuthPlane

Open source OAuth 2.1 authorization for MCP servers. Self-hosted. One binary. Production-grade MCP auth in under 10 minutes.

[AuthPlane @AuthPlane]

Is your MCP secure? Not sure? We just launched AuthScanner so you can find out in a couple of minutes.

AuthScanner is a free tool that checks how your MCP server handles OAuth and authentication, then gives you a clear report on what's working, what's not, and how to fix it.

Heading to #AGNTCon + #MCPCon Europe in Amsterdam next week? Stop by the AuthPlane booth and we'll run a scan with you.

#MCP #OAuth #AgenticAI #AIAgents #APISecurity

https://t.co/a3Ym5POSXC

[AuthPlane @AuthPlane]

agree on the diagnosis. one nit: "almost no one wires up 8693/8707" — an authorization server in front of the MCP server does that for you, and 8707 + exp already covers the bind-to-resource point in the replies.

the per-tool grant also has a standards home: RFC 9396 authorization_details on an ordinary OAuth token, so the agent doesn't need a vendor key and the person can narrow the grant at approval instead of an admin after the fact. that's the direction we're taking with AuthPlane. https://t.co/We6g3566lX

[AuthPlane @AuthPlane]

if it's always one specific client, that's the OAuth dance — Claude Desktop, Claude Code and Inspector each do it slightly differently, so what works for one breaks the next.

check out AuthPlane: open source auth server for MCP, tested against each client for real, with TS / Python / Go SDKs so your server just gets a verified token. https://t.co/We6g3566lX

which client is it?

[AuthPlane @AuthPlane]

Link to GitHub: https://t.co/YJef8Ycs3E

[AuthPlane @AuthPlane]

AuthPlane now supports MCP 2026-07-28, the largest auth revision since the protocol launched.
What's in it:

- CIMD replaces Dynamic Client Registration
- RFC 9207 issuer validation on every auth response
- Credentials bound to the issuing AS
- offline_access for refresh tokens
- Standardized scope step-up

Open source. Self-hosted. OAuth 2.1 built for agents.

#MCP #AI #AIagents

[AuthPlane @AuthPlane]

Link to GitHub: https://t.co/YJef8Ycs3E

[AuthPlane @AuthPlane]

We just shipped SDKs across five languages.

C# / .NET: our first release. AuthPlane SDK targets .NET 8 and .NET 10.
Java: now on Maven Central as ai.authplane.sdk, with adapters for the official MCP Java SDK and Spring Boot. v0.2.0 follows key rotation on your authorization server automatically. Requires Java 21+.
Go: v0.3.0 tightens issuer validation across the whole SDK per RFC 8414. Breaking change, check the changelog before you upgrade.
TypeScript: v0.4 adds native support for Hono and NestJS and integrates with the official MCP TypeScript SDK's auth middleware. Also a breaking change; read the migration notes first.
Python: v0.4 adds fail-closed behavior for FastMCP and MCP servers, so requests are turned away when revocation status can't be confirmed, and adds stricter validation at startup.

Pick your language, install from your package manager of choice, and protect your first endpoint today.

#OAuth #MCP #DeveloperTools #SDK

[AuthPlane @AuthPlane]

Excited to be heading to #AGNTCon + #MCPCon Europe on September 17-18 in Amsterdam. The agenda is packed with real talk on what it takes to actually build and scale agentic AI systems in production: orchestration, infrastructure, evaluation, resilience, observability, debugging, all of it. If you're going too, would love to connect there. @linuxfoundation

Schedule ➡️ https://t.co/unBsC87PlQ
Register ➡️ https://t.co/s1BUsrlQfS

[AuthPlane @AuthPlane]

The winner of the AuthPlane x Skybridge Speedrun Challenge is Tanish Desai, with his app, Rolelense. We would like to thank all the participants who submitted a project and made this competition a tough one. We will share other submissions as well, since they were Sooo good and deserve a spotlight.

Special shout-out to our partner @alpic_ai whose platform made these apps possible!

Congrats again Tanish!!

[AuthPlane @AuthPlane]

Last day of the Speedrun Challenge. Submissions close tonight at 11:59pm your local time.

If you've got something running, five minutes of video is all we need. Send it in.

https://t.co/9rIcceJnJM

[AuthPlane @AuthPlane]

The Speedrun Challenge closes Monday, so you've got the weekend.

Build something with Skybridge, put AuthPlane in front of it, send us five minutes of video. That's all it is. And if you're stuck somewhere, reply and we'll help you sort it out.

$500, deadline Aug 31.
https://t.co/LPzWLM8iPk

[Skybridge @Skybridge_ai]

There is one week left to enter the Skybridge x @AuthPlane Speedrun Challenge!

Stuck on the build? DM us and we'll help.

The winner will get $500, don't miss your chance. More info: https://t.co/Ld6509GrhU

[AuthPlane @AuthPlane]

One week left in the AuthPlane x Skybridge Speedrun Challenge. Office hours today for anyone stuck on setup. $500 prize, deadline Aug 31.

https://t.co/9rIcceJnJM

[AuthPlane @AuthPlane]

If you're looking at Keycloak for MCP auth, its docs and its code disagree.

RFC 8707 has shipped since 26.6, but it's experimental and off by default. The MCP guide still says "Not supported" and has you building audience mappers by hand.

Verified against the 26.7.1 source:
https://t.co/VQWiiayNCU

[AuthPlane @AuthPlane]

Nice writeup. Eliminating local proxy software is the real win for developer experience here. For teams whose infrastructure isn't entirely inside AWS though, this is a good reminder that the pattern (browser based OAuth, no local proxy) is achievable with any standards compliant authorization server, not just AWS Sign-In.

[AuthPlane @AuthPlane]

The stateless shift paired with formal OAuth 2.0/OIDC support is the bigger story here even though it's getting less attention than it deserves. Moving durable state out of the MCP server and into the authorization server is the right architectural call, it's what lets MCP servers actually scale horizontally instead of pinning sessions.

[AuthPlane @AuthPlane]

This is a real gap and the workaround (spinning up duplicate server instances per account) shouldn't be necessary. Multi account support at the authorization layer, not the server layer, is exactly the kind of thing that gets missed when auth is treated as a per server bolt-on instead of shared infrastructure.

[AuthPlane @AuthPlane]

Worth reading in full. The tradeoff Akamai is flagging (tighter OAuth enforcement shifting risk into state management) tracks with what we've seen too, closing one attack surface in a spec update often just moves the hard part somewhere else in the implementation. Audience binding solves token misuse, it doesn't solve session state design.

[AuthPlane @AuthPlane]

@AlphaSignalAI The read/write split here (bearer for reads, real OAuth for writes) is the right instinct and more MCP servers should default to it. Scoping by action type, not just by resource, is exactly the kind of granularity that gets skipped when teams bolt auth on as an afterthought.

[AuthPlane @AuthPlane]

The Speedrun Challenge is underway and there's plenty of time left.

Skybridge is a React framework, so most of it will feel familiar. AuthPlane goes in front with one docker run. Five minutes of video showing it working is the whole submission.

$500, closing Aug 31.

https://t.co/TsPXm0uGv1