MCP OAuth: let users trust their own redirect URIs safely

The author examines how Model Context Protocol OAuth implementations suffer from insecure redirect URI handling, enabling phishing attacks and open redirect vulnerabilities. To solve this safely without relying solely on operator-maintained allowlists, the author proposes a per-user trust model where users explicitly authorize exact redirect addresses during the sign-in flow. This approach prevents unauthorized code interception while maintaining flexibility for custom client connections. Open article →