The State of MCP Auth - Michael Grinich, WorkOS скачать в хорошем качестве

The State of MCP Auth - Michael Grinich, WorkOS

How do we secure the next generation of AI integrations? Model Context Protocol (MCP) is becoming the interface layer for LLMs, agents, and ChatGPT apps to interact with the world. Michael Grinich, Founder & CEO of WorkOS, lays out today’s security gaps, likening MCP’s current state to the pre-HTTPS internet, and explains how OAuth 2.1 and dynamic client registration form the backbone of a safer, standards-based authentication model. Grinich notes that roughly 65% of MCP servers still rely on API keys, resulting in cumbersome user flows and weak security. He shares best practices for building robust MCP servers, from designing tools around real tasks (not raw endpoints) to implementing solid audit logging and access control for fast-moving autonomous agents. The talk wraps with a live demo: using conversational AI and MCP to order swag directly through a ChatGPT app. WorkOS is a developer platform for building enterprise-ready applications. It provides authentication (including SSO, OAuth, and Magic Auth), directory sync (SCIM and HRIS integrations), and user management through a unified API. WorkOS abstracts dozens of enterprise integrations into a single interface, supporting more than 20 enterprise services. The platform includes AuthKit for flexible authentication UI and an Admin Portal for IT administrators to configure SSO directly. 🔗 CONNECT WITH MICHAEL GRINICH LinkedIn:   / grinich   Twitter/X: https://x.com/grinich WorkOS: https://workos.com 📚 MASTRA RESOURCES Mastra: https://mastra.ai Learn Mastra in the world's first MCP-Based Course: https://mastra.ai/course Principles of Building AI Agents (Book): https://mastra.ai/book Patterns for Building AI Agents (New Book): https://mastra.ai/blog/patterns-book https://docs.google.com/forms/d/e/1FA... The TypeScript AI conference is the first conference for TypeScript AI developers. The inaugural event took place on November 6, 2025, in San Francisco and online. MASTRA? Mastra is an open-source TypeScript framework designed for building and shipping AI-powered applications and agents with minimal friction. It supports the full lifecycle of agent development—from prototype to production. You can integrate it with frontend and backend stacks (e.g., React, Next.js, Node) or run agents as standalone services. If you’re a JavaScript or TypeScript developer looking to build an agentic or AI-powered product without starting from first principles, Mastra provides the scaffolding, tools, and integrations to accelerate that process. 00:00 Intro 00:05 MCP and Auth Challenges 01:16 What is MCP 02:41 Building MCP Servers: A Quick Overview 03:29 Security Concerns and Vulnerabilities in MCP 04:30 Key Security Components: Auth, Registry, and Audit Logs 05:26 OAuth 2.1 and Dynamic Client Registration in MCP 06:54 Current State of MCP Auth Adoption and Challenges 07:54 Best Practices for Building MCP Servers 09:40 Managing MCP Server Usage Within Organizations 11:05 Demo: Connecting MCP Shop to ChatGPT Apps 13:01 Demo: Browsing MCP Shop Inventory via ChatGPT 14:30 Demo: Ordering a Shirt Through MCP Integration