Egor Urvanov

OAuth

MCP and safety

Sign-in through the browser: when the agent connects to a service, the harness opens that service sign-in page, you type the password there and approve access, and the agent gets a token. The agent never sees the password; the token is limited to the granted permissions and can be revoked. This is how MCP servers connect to Jira and Sentry, for example.

sign inMCPagentservice pagein the browsertoken with the agentscoped, revocableservice MCP server1 · opens sign-in3 · issues a token4 · requests with the tokenyou2 · enter the password and approvethe password stays on the service page; the agent never sees it● model, people, systems, data  ● agent and harnessYou type the password on the service page, the agent gets only a token

Source: MCP spec: Authorization

Where it appears · 2

Related terms

Whole glossary

© 2026 Egor Urvanov