Identity Best Practices to Secure & Scale Agentic AI / MCP Deployments
summary
More than 5,000 MCP servers appear in registries yet over 2,000 expose no security and only about 13% ever deploy, so the core takeaway is concrete: implement OAuth 2.1 with a separate IDP, require dynamic client registration, and map one scope per tool so agents get least privilege. Store third‑party tokens in a vault like HashiCorp Vault and never pass those tokens to agents. Support progressive consent flows that return 403 with www-authenticate so clients can request additional scopes and audit every token lifecycle.
AI-written summary · about
chapters (8)
- 0:00Introduction to MCP servers
- 1:12Why build internal MCP servers
- 4:20Internal vs external MCP use cases
- 6:05Common MCP security challenges
- 7:51Identity tips for MCP servers
- 13:52Consent management in MCP
- 15:39Token lifecycle and risk assessment
- 16:23Q&A session
related talks
52mAI Agents Need Permission Slips
26mWho Let the Agent In? Securing MCP Servers in Production
25mOAuth Gets You In, Zero Trust Keeps You Safe
20mEvolution of MCP auth
29mMCP Security: Keep Your AI Agents from Spilling the Tea
45mSecuring MCP Servers with Spring AI
35mIdentity and Access Management for the Decade Ahead
25mWho Let the Agents Out? Securing AI Workflows the Right Way