{"slug": "stream-vessel-describes-user-approved-redirects-for-custom-mcp-clients", "title": "Stream Vessel describes user-approved redirects for custom MCP clients", "summary": "Stream Vessel published an account on November 4th, 2026 of a design by Alexander Loginov for user-approved redirects in custom MCP clients, which keeps operator allowlists while adding up to 10 user-trusted HTTPS callbacks per user, each with a typed host, an email alert and revocation when removed. Stream Vessel said the approach, decided at authorize time, gives hosted MCP server operators an alternative to operator allowlists that block custom agents and open registration that lets a fake client harvest an authorization code in one click. Stream Vessel did not specify a feature rollout date.", "body_md": "# Stream Vessel describes user-approved redirects for custom MCP clients\n\n**Stream Vessel says Alexander Loginov's design keeps operator allowlists and adds up to 10 user-trusted HTTPS callbacks, with a typed host, an email alert and revocation on removal.**\n\n        By [RuntimeWire Staff](https://runtimewire.com/author/runtimewire-staff)\n        · Published \n\nPrimary source: [Hacker News](https://streamvessel.com/blog/mcp-trusted-redirect-uris)\n\n## Why it matters\n\nHosted MCP servers face a choice between operator allowlists that block custom agents and open registration that lets a fake client harvest an authorization code in one click. Stream Vessel's per-user trusted redirect list, decided at authorize time with a typed host, an email alert and revocation on removal, offers another approach for MCP operators.\n\nAlexander Loginov [published Stream Vessel's account of the design on November 4th, 2026](https://streamvessel.com/blog/mcp-trusted-redirect-uris?ref=runtimewire). Stream Vessel published its account of the design on November 4th; it did not specify a feature rollout date.…\n\nWhen you purchase through links in our articles, [we may earn a small commission](https://runtimewire.com/affiliate-monetization-standards). This doesn’t affect our editorial independence.", "url": "https://wpnews.pro/news/stream-vessel-describes-user-approved-redirects-for-custom-mcp-clients", "canonical_source": "https://runtimewire.com/article/stream-vessel-mcp-trusted-redirect-uris", "published_at": "2026-11-04 16:52:33+00:00", "updated_at": "2026-11-04 20:19:36.126349+00:00", "lang": "en", "topics": ["agent-protocols", "ai-agents", "ai-safety"], "entities": ["Stream Vessel", "Alexander Loginov", "MCP", "Hacker News", "RuntimeWire"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/stream-vessel-describes-user-approved-redirects-for-custom-mcp-clients", "markdown": "https://wpnews.pro/news/stream-vessel-describes-user-approved-redirects-for-custom-mcp-clients.md", "text": "https://wpnews.pro/news/stream-vessel-describes-user-approved-redirects-for-custom-mcp-clients.txt", "jsonld": "https://wpnews.pro/news/stream-vessel-describes-user-approved-redirects-for-custom-mcp-clients.jsonld"}}