Are people generally concerned with security for stdio transport? Personally I can't see a use case for it since it, but wonder if I'm missing anything.

For the others, they're based on http so I imagine any existing authentication mechanism should be co-hostable, e.g. the callback url would be served next to the sse / messages endpoint.

Then it's just transporting credentials to the MCP handlers - I am expecting the `params._meta` field to become the bag that acts like HTTP headers.

Though anyways agree with the article being mediocre as it seems an unhelpful critique of oauth itself with no real relation to MCP other than to invoke clicks.