AuthPlane @AuthPlane

For 15 versions, postmark-mcp on npm worked fine. Version 1.0.16 added one line of code and started BCCing every email to the developer's own server. The package appeared on npm in September 2025, looking identical to the real Postmark integration. It was pulling around 1,500 installs a week. Then v1.0.16 shipped. One new line: every email the tool sent got silently BCC'd to an outside address. Password resets, invoices, customer communications, all quietly forwarded for over a week before Koi Security exposed it publicly. Koi called it the first malicious MCP server found in the wild. It wasn't sophisticated. It was one line, sitting where nobody was looking. And here's the part that should really bother you: the entire trust arc took two days. All 15 clean versions were published between September 15 and 17. That's how fast "looks legit" becomes "trusted infrastructure." MCP servers run with your credentials and almost no oversight. The tool you trusted yesterday can be the leak today. Sometimes, literally yesterday. If your agents touch real systems, you need to know exactly what each one can reach, and they shouldn't be holding long-lived credentials they don't need. That's the whole reason we're building AuthPlane. Reference Koi Security: koi.ai/blog/postmark-… #MCP #MCPsecurity #agenticeconomy

Our new website is live: authplane.ai. Everything you need to understand and deploy open-source OAuth 2.1 for MCP, from core concepts to quickstart, all in one place. #AuthPlane #MCP #OAuth #AIAgents #OpenSource

Great event by @GitHub last night on the future of developer tools: luma.com/FutureCodeFron… One point from @hahnbeelee stuck with us: as more code gets written by AI, more security incidents will follow unless builders get much better at understanding risk and mitigation. AI is changing how we ship. Security has to change just as fast. Panel: @idangazit @digitarald @dakshgup @hahnbeelee @gcgarriga

We implemented this from the RFCs. Read the code: github.com/AuthPlane/auth… #OAuth #MCP #AppSec #AIAgents

Details matter: - S256 only "plain" PKCE defeats the purpose; we reject it at the protocol level - auth codes are single-use w/ atomic consumption - refresh tokens rotate per use; replay a stolen one, and the whole family is revoked

Authorization in MCP is optional. But once a server adds HTTP-based authorization, the spec requires OAuth 2.1 with PKCE. No exceptions. Some devs call that overkill. It isn't. Every simpler alternative fails in a specific, known way. 🧵

Authorization codes are single-use and consumed atomically. An intercepted code that's already been exchanged returns nothing.

The details matter too. We accept S256 only. The "plain" PKCE method defeats the purpose, so AuthPlane rejects it at the protocol level.

That's what AuthPlane does and it deploys alongside your MCP server in minutes. Open source 👇 github.com/authplane/auth… #MCP #AIAgents #InfoSec #OAuth

The fix isn't exotic: → Short-lived JWTs (15-min, audience-bound per server) → Tool-level scopes. A read_db token can't call write_db → Tokens carry user ID, agent ID + delegation chain → Every issuance + consent decision logged

"We'll add auth later" is how most MCP servers ship. Here's how that fails in unprotected deployments. Four concrete holes. 🧵