The latest version of the MCP spec is now officially 2025-06-18! Congrats to everyone in the MCP community involved in making this happen!

Key updates to the authorization section:

⚙️ MCP Servers are no longer responsible for issuing access tokens or handling user authentication
🛡️ A dedicated Authorization Server separate from the MCP Server handles user authentication and issuing access tokens
🔍 RFC9728 Protected Resource Metadata enables the MCP client to dynamically discover the MCP Server's authorization server
👉 RFC8707 Resource Indicators are required as a security measure

Thanks to everyone who contributed to the many discussions to update the authorization part of the spec to be more compatible with existing OAuth systems!

David Soria Parra, Paul Carleton, Den Delimarsky, Nate Barbettini, William Dawson, Jared Hanson, Karl McGuinness, Darin McAdams, Jean-François LOMBARDO and apologies if I forgot to mention you, those threads were extremely long!

#modelcontextprotocol #mcp #oauth #ai

TIL the point up emoji ☝️ doesn't work as a reaction on iMessage because Apple displays the emoji above the message it's a reaction to 😂

I’m just gonna say, I feel like a laptop with its lid closed should not take priority over the bluetooth connection to the headphones I just turned on.

In two weeks I'll be speaking at the MCP Dev Summit in San Francisco! It's going to be a great day packed with back to back sessions.

In less than a year, the MCP project has quickly reshaped how developers are building AI agents. My talk, "Intro to OAuth for MCP Servers", will cover the basics of the new MCP authorization protocol and set the stage for building secure MCP servers.

https://mcpdevsummit.ai/#agenda

This is so silly, I just need to vent. I have this Krups waffle iron, and part of the locking handle has been broken since I got it. I took it apart (really just removed like 6 screws) and there's clearly a plastic part that broke off inside.

So I go to the Krups website and find the replacement part which is available for $3.90, except that shipping is $15.

I emailed their customer support and said I need this replacement part. They wrote back that parts are available on the website for out-of-warranty repairs. I wrote back that it's still under warranty. Their reply:

"Disassembling the unit will void the warranty."

So I called up support to see if they would say anything different on the phone. They asked for my name and then pulled up my ticket, and the guy confirmed that because I opened it up I voided the warranty, and that they don't do warranty repairs by sending out parts anyway.

So apparently I was not supposed to diagnose the problem myself, instead I was supposed to ship it to the appliance repair store in Seattle for them to replace the part and ship it back. It just seems so wasteful and expensive to mail it back and forth when all I need is this $3.90 part.

I absolutely do not understand the math on this, but it does make sense intuitively.

https://docs.vention.io/docs/designing-with-t-slot-aluminum-extrusions

oh no I just realized tomorrow is Monday

This is the second time this month that my boarding gate and seat number are palindromes of each other

Is it just me or does this current Model Context Protocol wave remind anyone of the early Web 2.0 days of everyone launching open APIs?

I have 24 hours in Hong Kong on the way back home because of how I had to book the flights. I took a short flight from Da Nang to Hong Kong and I have a separate ticket for HKG-SFO-PDX.

I ended up clearing immigration with the bags around 8:45pm, and my flight out is at 8pm tomorrow, so I was able to go up to the checkin counter and get my boarding pass and check the bag in already.

We bought so much stuff that we had to buy a new suitcase in Hoi An. We were pretty rushed packing this morning after picking up the last of the clothing. So in the airport I did some rearranging between the bags.

I moved some of my old cheap clothes and laundry into the new large suitcase to make room to move some of the new custom clothes into my small suitcase. I checked the big suitcase but I should be able to take the small one as carryon. I figure better to spread out the risk instead of checking both bags. Oh and I also had to buy a strap for the new bag because I don’t trust the zippers entirely. Now it’s also easier to spot.

So cross your fingers that in 36 hours I will find the bag in SFO when I clear immigration!

And of course the checked bag has an AirTag in it so I'll be able to keep an eye on it in the mean time.

I've got 22 hours in Hong Kong on a layover and I'm staying overnight in a hotel near the old Kowloon Walled City. Any tips for what I should do on this very short trip?

The building that collapsed from the earthquake was right next to the train station we got off at when we arrived in Bangkok last weekend. We took the train from Chiang Mai to Chatuchak 😮 https://maps.app.goo.gl/YUANzTLHUfCZVi6b7

Got the whole row to myself, almost makes me sad the flight is only 50 minutes

In case you missed it, our IPSIE webinar recording is now available! I had a great time chatting with Dean H. Saxe, George Fletcher, Gail Hodges, and Jeff Reich about what IPSIE is, why profiling existing specifications is so important, and the progress the working group has made so far! Thanks for the great conversation!

IPSIE:
Interoperability
Profile for
Secure
Identity in the
Enterprise

https://www.brighttalk.com/webcast/18458/636068

The extremely custom range hood is getting closer! The hood insert will slide in from the bottom, and the top part will have storage in front of the duct!

Today the crew hung the picture rails everywhere. It will eventually be painted the same color as the walls. I'm looking forward to never having to punch holes in the walls again!

Chase sends 8-digit 2fa SMS codes, which seems excessive compared to the 6 that most other places use, but even weirder is that the first digit of them has always been the same, effectively making it a 7 digit code. Anyone know what's up with that?

At long last, the OAuth working group has finished the Best Current Practice for OAuth 2.0 Security and it was just published as RFC9700! This has been a long time in the works, and I'm very thankful to everyone who has helped out with it over the years!

https://www.rfc-editor.org/rfc/rfc9700.html

This is one of the major inputs to OAuth 2.1, so I'm also very excited to be able to move that forward this year as well!

Every now and then I remember how in 2014 I mined $20 worth of dogecoin, then said this is stupid and exchanged it for 0.05 bitcoin sent to a brainwallet. I can't remember the seed phrase, so it's just stuck in the blockchain, and is now worth $5000

I am still getting monthly emails saying I have a $0 balance from the tenant portal of the apartment we moved out of 18 months ago. Today I logged in to see if I can delete my account, but instead I see new maintenance requests from the last few months 😮