Analysis · curated 28 Jun 2026
Shipping an OAuth-protected remote MCP server: the spec, 3 security bugs, and a Cloud Run gotcha
First reported skilldb.dev
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
Properly implementing OAuth on remote MCP servers is increasingly important as agentic clients like Claude Desktop connect to third-party tool servers, and misconfigured auth can expose agent-accessible resources.
An engineering blog post from SkillDB describing how they turned their MCP server into a remote, OAuth-protected MCP server for Claude Desktop, covering the MCP authorization spec (RFC 9728 protected resource metadata, 401 Bearer challenge), three OAuth security bugs caught in review before launch, and a Cloud Run infrastructure issue.