The latest version of the MCP spec is now officially 2025-06-18! Congrats to everyone in the MCP community involved in making this happen!

Key updates to the authorization section:

⚙️ MCP Servers are no longer responsible for issuing access tokens or handling user authentication
🛡️ A dedicated Authorization Server separate from the MCP Server handles user authentication and issuing access tokens
🔍 RFC9728 Protected Resource Metadata enables the MCP client to dynamically discover the MCP Server's authorization server
👉 RFC8707 Resource Indicators are required as a security measure

Thanks to everyone who contributed to the many discussions to update the authorization part of the spec to be more compatible with existing OAuth systems!

David Soria Parra, Paul Carleton, Den Delimarsky, Nate Barbettini, William Dawson, Jared Hanson, Karl McGuinness, Darin McAdams, Jean-François LOMBARDO and apologies if I forgot to mention you, those threads were extremely long!

#modelcontextprotocol #mcp #oauth #ai
#modelcontextprotocol #mcp #oauth #ai

Link: Snyderbros are Just the Worst

RSS Rants

#errata #technical #rss #site-improvement

I persevere

#birthday #trans #trans academy #LGBTQ+

Losing the Fun of Being a Newbie (and Trying to Get it Back)

Link: Abrego Garcia is Having His (First) Day in Court

Link: Still Hungry, Still Foolish

Superpositional mood

#blogging #mental health #music #vertigo #choir

Please help support legal costs for an asylum seeker in our Southern California community. They were kidnapped by ICE at their court hearing: https://gofund.me/24440eda

Any amount helps and boosting appreciated. 💛

#MutualAid #AbolishICE

Earworms for June

#music #videos #earworms #music-video
Presenting "The State of OAuth" at Identiverse
#oauth #identiverse #365 #okta
Identiverse IPSIE panel
#ipsie #365 #okta #identiverse

A Nomad’s Pacific Northwest Travelogue, Part III

Tools, 2025 Edition

#life #technical #tools

Link: Kilmar Abrego Garcia is Back on American Soil, Facing Bogus Charges

Wrote a few words about the upcoming end of Glitch project hosting and missed opportunities. Then wrote way more words about a few specific personal projects that got their start there.

https://martymcgui.re/2025/06/07/glitched-out/

Glitched out

#glitch #hosting #shutdown #2025 #IndieWeb #projects

Link: Behind the Underwater Scenes of “Final Reckoning”

A handy note for future-me or any other WordPress plugin developers:

If you need a plugin admin link that performs a download (e.g. a CSV file), you will need to use a hook that is called earlier in the process, before WP sends HTTP headers/content to the browser.

With a typical plugin admin page that displays content, I would use:

add_action( 'admin_menu', 'foo_add_menu' );

Then in function foo_add_menu(), I would use add_menu_page like:

// my example is OO, so $this points to the object and calls the index() method
add_menu_page(
    'Plugin Page Title', 
    'Plugin Menu Title', 
    'edit_posts', 
    $this->plugin_name . '_index', 
    [$this, 'index'], 
    ''
);

If you try to do this with a method that starts a download, you will get errors like “Cannot modify header information.” This StackOverflow answer pointed me in the direction of the load-page hook to solve that.

That documentation is a bit slim, but what I figured out was add_menu_page() returns a hook name. You can take that hook name, prefix “load-”, and use the resulting string as the hook name in an add_action().

In my example above, let’s say the plugin name is “foo_plugin” and replace “index” with “download”. The resulting hook name would be:

load-admin_page_foo_plugin_download

Then I can use:

add_action( 'load-admin_page_foo_plugin_download', 'download' );

(Be careful with the hyphen vs underscores in that)

Finally, within the download() class method, I can safely modify HTTP headers to start a download:

header('Content-type: text/csv; charset=utf8');
// other headers and content...
📗 Want to read The Book of Alchemy by Suleika Jaouad ISBN: 9780593734636