Jared Hanson

Co-founder @keycardlabs. 🛠️ @passportjs. ❤️ HTTP 401-403. #openid #oauth #wimse #mcp #x402

[Jared Hanson @jaredhanson]

@pavinduLakshan I tend to agree. What makes an API agent ready? For all its flaws, MCP is an answer to that question.

[Jared Hanson @jaredhanson]

The latest changes to MCP paradoxically make the protocol both better and more crufty. For instance, many RPC params are now duplicated as HTTP headers.

[Jared Hanson @jaredhanson]

There’s a big difference between auth for agents, and auth for MCP. I want to hear people’s experience with the former.

[Jared Hanson @jaredhanson]

SOAP had this same issue. Ultimately people moved off it and dropped RPC semantics.

[Jared Hanson @jaredhanson]

@yenkel @woloski @portalbosque_ Humans like work. We create technologies that create work. (“work” can also be read as “opportunity”)

[Jared Hanson @jaredhanson]

More REST, less SOAP.

[David Soria Parra @dsp_]

The release candidate for MCP 2026-07-28 is out. The protocol is now stateless: no handshake, no session id, any request can hit any server instance. Plus extensions as first-class (MCP Apps, Tasks), auth hardening, and a proper deprecation policy so we don't have to do this again.
https://t.co/XRLTu1BSkB

[Jared Hanson @jaredhanson]

@0xblacklight @RhysSullivan @aaronpk That said, you need to be an approved partner to get those details. I’m not on that list (yet!?). I’ve applied, but if anyone knows how to get access to the spec at least - I’d love to know.

Paging @jeff_weinstein @irvinebroque

[Jared Hanson @jaredhanson]

@0xblacklight @RhysSullivan @aaronpk Re: Stripe Projects. That is apparently supposed to be an open protocol - alluded to in Cloudflare’s support announcement: https://t.co/ngeV5wWNtQ

I’m really excited about this, and have been eager to implement and give feedback.

[Jared Hanson @jaredhanson]

@RhysSullivan I’d love to chat with you about what we are doing @KeycardLabs

[Jared Hanson @jaredhanson]

When credentials expire in minutes, there’s no need to vault them.

[Jared Hanson @jaredhanson]

Turns out it’s safer to execute code from an LLM than from npm.

[Jared Hanson @jaredhanson]

@matthewcp 🙌

[Jared Hanson @jaredhanson]

@FredKSchott @MikeNomitch_CF It’s beautiful. You are certainly onto something special.

[Jared Hanson @jaredhanson]

@yenkel @dwarkesh_sp Same. I may be feeling more inadequate than weak, seeing how the LLM is able to grasp and explain concepts much more quickly.

[Jared Hanson @jaredhanson]

I like to read. And I like to deeply understand the details. I sometimes worry this is a weakness in the LLM era. Anyone else feel this way?

[Jared Hanson @jaredhanson]

@DominikTornow @badlogicgames I like anything that evokes Smalltalk. Must be why I like Pi.

[Jared Hanson @jaredhanson]

@dangtony98 So… OAuth.

[Jared Hanson @jaredhanson]

@DNAutics JavaScript will also never die.

[Thomas H. Ptacek @tqbf]

"Replacing long-lived keys with ephemeral keys is, for my money, one of the best uses of security engineering effort." is the best sentence I've read pertaining to my field in awhile. More at:

https://t.co/HY8WhrYJjp