OAuth
AssessTools
An authorization framework used to scope AI agents and limit access to specific resources.
Why it's here
Placed in Assess: 8 article(s) of evidence from 4 source(s), led by product launches, with 0 in the last 30 days. Confidence 71%.
Evidence (8)
- 8The New Stack·9/10/2026securityResearchers find over 20% of MCP access policies were broken or missing
A report on the Model Context Protocol (MCP) says the ecosystem has significant authorization and credentialing gaps, including broken or missing access policies in more than 20% of reviewed MCP-related cases. The article also cites prior research showing prompt-injection style attacks, overbroad scopes, and static tokens as common security weaknesses in MCP deployments.
- 7The New Stack·8/22/2026securitySix identity controls for securing autonomous AI agents
The article argues that autonomous AI agents require identity and access controls beyond traditional human or service-account IAM. It outlines six capabilities for production use, including verifiable agent identities, short-lived credentials, and continuous Zero Trust governance.
- 7Hacker News·8/22/2026framework_updateMCP roadmap expands protocol work on messaging, transport, and identity
The Model Context Protocol (MCP) team published an updated roadmap for the next specification release and beyond. It prioritizes agentic messaging primitives, HTTP-native transport unification, enterprise-ready agent identity and security, improved primitives, and better SDK developer experience. The roadmap also highlights ongoing work on server-initiated events, Tasks, subscriptions, progress notifications, DPoP, and related OAuth standards.
- 7The New Stack·8/20/2026product_launchSlack simplifies installing third-party AI agents
Slack launched Add to Slack, a new installation flow that lets users add agents built on partner platforms without creating a custom Slack integration. The runtime stays outside Slack, while OAuth, app configuration, and permission scoping are handled by the partner tool; installed agents also inherit workspace access controls and appear in Slack’s app browser.
- 7InfoQ·8/20/2026framework_updateCloudflare adds task-based OAuth scope consent
Cloudflare has introduced OAuth scope customization, allowing client owners to mark scopes as required or optional during authorization. Users can now grant a narrower set of permissions at consent time, while existing OAuth flows remain unchanged unless apps opt in.
- 6The New Stack·8/17/2026product_launchClaude can manage ElevenLabs voice agents through a hosted MCP connector
ElevenLabs launched a hosted MCP connector that gives Claude read/write access to existing ElevenAgents, letting developers inspect, edit, test, and even delete production voice agents from chat. The connector uses OAuth instead of local API keys and adds access controls plus testing tools to reduce the risk of unsafe changes.
- 6The New Stack·7/16/2026product_launchGoDaddy opens domain registration to developer and AI workflows
GoDaddy launched a Developer Platform that lets teams search, buy, configure, and manage domains from within development tools instead of using the registrar web dashboard. The release includes APIs, a CLI, OAuth-based access controls, and purchase safeguards such as quote-then-execute flows, idempotency keys, and human approval for automated or AI-driven actions.
- 6The New Stack·6/30/2026open_sourceRSK revives IdentityServer4 as open source fork
Rock Solid Knowledge has launched Open.IdentityServer, an open-source fork of the IdentityServer4 codebase, to provide a maintained alternative for developers after Duende commercialized the original project. The platform supports OpenID Connect and OAuth 2.0 for .NET applications, with the core remaining free and commercial extensions optional.