Building Protected MCP Servers
summary
Claims that the new MCP draft spec removes the need for servers to mint tokens by delegating minting to standard authorization servers (Entra ID, Okta, Keycloak), shows a working ASP.NET Core example that exposes a PRM protected resource metadata JSON and validates headers, and lands a C# SDK PR that configures MCP auth with a few lines. A GitHub repo deploys an Azure API Management gateway via ARM/ACD script, wires Entra consent, and VS Code + GitHub Copilot demo connects to three tools successfully end to end.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:02Why protect MCP servers
- 3:08Evolution of MCP authorization
- 5:16Benefits of new spec
- 7:00How new spec works
- 9:27C# SDK demo
- 12:55Production with API management
- 16:29VS Code integration
- 18:16REST to MCP conversion
- 19:22Getting started resources
related talks
15mFast Focus - Introduction to Model Context Protocol (MCP) Servers
45mSecuring MCP Servers with Spring AI
26mWho Let the Agent In? Securing MCP Servers in Production
30mLet's make an MCP Server!
44mSupercharging DevOps with MCP (Without Opening a Security Hole)
25mAre MCP Servers Dead?
29mMCP in 2026: Context is All You Need
35mMCP, or not MCP