The standard has a page on authorization[0], though it's not particularly easy to read for someone not well-versed with OAuth.
In short, MCP just uses plain boring oauth, like any other oauth authorization. Like when you authorize an app to access your google calendar. The only difference is that instead of accessing your normal API, they access your MCP http endpoint. Each connection to that endpoint will pass the Authorisation header with an oauth token, which you can resolve to a user on your side. Same as you would with normal OAuth.
One cool bit is that MCP providers are supposed to support OAuth2 Dynamic Client Registration, which means that e.g. Claude can provision an OAuth2 client in your app programmatically (and get a client_id/client_secret that it can use for authorization flows).
When you add an MCP server to your Claude organization, you just add the MCP server. Each user will have to go through the integration's OAuth2 authorization flow separately.
[0]: https://modelcontextprotocol.io/specification/2025-03-26/bas...
Check out https://aaronparecki.com/2025/05/12/27/enterprise-ready-mcp - there are some great ideas there on how this can be simplified even more in the future.
I have built a couple using the spec from a month ago. It works alright.
A lot of bad decisions are in the official implementations. For instance not using native Request / Response types in node, so you’re forced to write a bunch of garbage code to convert it, or install express just to use an mcp server.
If I had the time I’d really make my own mcp implementation in typescript at least.
I find most of the implementations to be so over engineered and abstracted on what could be simple function calls on top of the built in language
For simple stuff like a json file that returns the location of your auth routes, you need to add a “middleware”
When in reality you can just make a route and explicitly return that information.
Every piece is some new abstraction it feels vibe coded.
Most of the standard and implementation is focused in the vision of models and clients that automatically handle the tool overhead, while in reality everything that is related to MCP requires tons of boilerplate/middleware/garbage code.
For example, when you try to integrate with AI model that supports function calling in the backend and want to use MCP server to enhance the model.
I haven't figured that out yet. Maybe you would need to use Client-Initiated Backchannel Authentication Flow ?
There's basically a couple of different ways to implement an MCP server - for this demo it's a local binary that communicates over stdio, so no OAuth process is taking place. It's only meant to run on your local machine.
To make the demo simpler to explore and understand, the binary loads it's configuration (SnapTrade API client id, secret, and username and secret) from a .env file that you populate with your credentials which allows it to fetch the right data.
I'm sure one day we'll get 100.00% reliable outputs such that autonomous agents can do this, however that's not today.
You buy order flow from "free" retail brokers like Robin Hood (as a market maker) and then literally front run ALL trades. You then tell everybody you're giving them the best price (also the only price), lol.
In other words: legalized crime.
Here [0] is a funny paper where a group of llms attempt to manage a vending machine. It ended with them trying to contact the fbi.
Like, immediately, I want it to order me some groceries based on what it sees in my fridge and what I cook.
And to remind me to change my air filters. Or book my vacation for me, knowing I like a mediterranean vibe and Bistecco Florentine.
I am absolutely excited for all of this. It really is as big as the iPhone.
Two stories:
When my father was in Japan in the 1970s, he was strutting around like a rooster in an obnoxious, white suit and crossed paths with a Zen monk quietly sweeping a path. The monk looked up at him and my father felt, he said, about six inches tall. The dignity and focus of the monk put my father to shame.
I was once in Princeton, NJ, waiting to cross a crosswalk at a streetlight. Someone extremely famous (I think) and certainly incredibly wealthy was in a car at an intersection, waiting for the car in front of her to turn so she could proceed. She was beside herself -- honking, screaming, practically crying. Being asked to wait for someone else was more than she could stand.
Obviously these experiences relied on a lot of assumptions and interpretation on my and my father's part. I'm sure there were other ways of reading the monk and driver.
Regardless, when I imagine the world you're describing, what I see is a combination of my father in the white suit and the driver: spoiled, incompetent, impatient, egocentric people incapable of enduring the indignity of having to make any decisions for themselves, wait for anything, or stoop to the humiliating depths of thinking about the boring stuff. In a weird, backwards way, what you're describing also sounds like subservience to me.
Smartphones are bad for people. This sounds much, much, much worse. I hope I die before/if the technology "matures."
Arent we taking the next step to the dystopia portrayed in Matrix. Many of us are already trapped in the social media matrix and manipulated by it. We can now outsource all our cognition and decision making to these machines, and sip cocktails on a beach, while these machines show us the narratives we want to hear.
Life’s too short to figure out what kind of curtains are best for my home.
But to be honest, I don't think it will get to the state you dream about, just like smart homes never got close and are more of a hassle than an actual life improvement. Unless it is almost 100% perfect it will error out in ways that are extremely annoying, ordering the wrong groceries, booking the wrong trip, etc. It's really hard to cross over the point where it's absolutely helpful without hiccups.
Seriously, every little annoying thing in life is going to be automated, so you get to free yourself to do the things you really want to do.
This thing already exists though, it’s called a personal assistant. And since you’re already not willing to spend $400 a month on getting one, likely reveals that this is not really a thing that you really need in your life. It’s a made-up preference, I am afraid.
The US labor force is at 4.5% unemployment. That's nowhere near enough for everyone to have personal assistants.
I'm not categorically against the development, but I want to categorically confirm bank transactions.
Honestly you wouldn't believe how good these models are if you haven't tried it. They really are amazing.
but if we do this, does this good for market??? since if everyone have access to this tool. meaning that market would get optimized to the ground and what happen to daily trader etc ???
does that mean everyone just win/lose money equally???
But a LLM could build a knowledge graph that parses niche news messages and tries to understand the entire picture and make bigger predictions.
The market is unfortunately not really efficient. Or well... too efficient at times (insider information).
This week I'm adding a SQL-based MCP server to my DataBento Golang Tutorial, but it's not there yet. [2]. That step will follow an MCP implementation like this, where it will just give a "sql" endpoint along with other tools to fill the database [3].
[1] https://github.com/NimbleMarkets/dbn-go/blob/main/cmd/dbn-go...
[2] https://github.com/NimbleMarkets/dbn-duckduck-goose
[3] https://github.com/AgentDank/dank-mcp/blob/main/data/us/ct/m...
Its very verbose, it writes a lot of code, but I just caught it, hard coding some replies to an API I was creating an introspection for. All this like in the middle of many hundreds of innocent lines of code.
Go and review every single line of code. This is a pro developer colleague that will fail you when you least expect. Frankly the time savings are minimal for professional quality code.
Some will say it was a problem with the prompt, but I would say it was mimicking the behavior I have seen professional developers do under a deadline. :-)
