OAuth Gets You In, Zero Trust Keeps You Safe
summary
MCP adoption spikes since MCP released Nov 2024 with OpenAI and Block clients; remote MCPs need layer‑7 controls, not VPNs. The claim is that an identityware proxy (IDP + policy engine + proxy) enforces instantaneous policy enforcement: demo fetches the latest 10 blog articles, then a policy change immediately denies the SQL tool call and logs the event. Upstream OAuth is handled at the gateway so tokens never leave the gateway via Pomearium identityware proxy, with Jaeger/Grafana‑style auditing.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 0:42MCPs and agentic access
- 3:58Zero trust fundamentals
- 8:15Identity-aware proxies
- 11:55Agentic access security gaps
- 13:20MCP security best practices
- 16:34VPNs fail for remote MCPs
- 17:57OAuth limitations in MCP
- 20:06Pomearium gateway demo
- 22:11MCP tool-level policy enforcement
- 23:57Cross-client MCP security
- 24:40Q&A
related talks
26mSecure Your MCP Servers with OAuth, JWT, SPIFFE and More
23mIdentity Best Practices to Secure & Scale Agentic AI / MCP Deployments
25mSecure Your MCP Servers With OAuth, JWT, SPIFFE and More
26mWho Let the Agent In? Securing MCP Servers in Production
27mSecuring the AI Revolution - [...]
29mKeeping Agents in Check: Apollo MCP Authentication
20mEvolution of MCP auth
23mOne Login to Rule Them All: Cross-App Access for MCP