Bobby Hall JrBobby Hall JrSoftware engineer
All tiny agents
Secrets & egress

MCP Issuer Pin

An MCP client that pins the OAuth issuer before it fetches anything.

What it does

It connects two clients to one honest MCP server and three hostile ones, and logs every secret that leaves the machine. The network, login provider and attacker are mocks.

The guardrail

OAuth issuer pinning for MCP clients.

MCPOAuthsecrets

Run it

git clone https://github.com/bobbyhalljr/tiny-mcp-issuer-pin.git && cd tiny-mcp-issuer-pin
npm install
npx tsx issuer.ts
Repo
tiny-mcp-issuer-pin
Language
TypeScript
Stars
0
Price
Free
View on GitHubRead the Dev.to post

More in Secrets & egress

Credential GatewayThe sandbox holds only a short-lived token. The real credential is injected outside.Egress PolicyDenylist vs allowlist vs default deny against one scripted escape.RAG Revocation GateCached retrieval results are references, not authorization.