Stream Vessel describes user-approved redirects for custom MCP clients

Stream Vessel published an account on November 4th, 2026 of a design by Alexander Loginov for user-approved redirects in custom MCP clients, which keeps operator allowlists while adding up to 10 user-trusted HTTPS callbacks per user, each with a typed host, an email alert and revocation when removed. Stream Vessel said the approach, decided at authorize time, gives hosted MCP server operators an alternative to operator allowlists that block custom agents and open registration that lets a fake client harvest an authorization code in one click. Stream Vessel did not specify a feature rollout date.

Stream Vessel describes user-approved redirects for custom MCP clients Stream Vessel says Alexander Loginov's design keeps operator allowlists and adds up to 10 user-trusted HTTPS callbacks, with a typed host, an email alert and revocation on removal. By RuntimeWire Staff https://runtimewire.com/author/runtimewire-staff · Published Primary source: Hacker News https://streamvessel.com/blog/mcp-trusted-redirect-uris Why it matters Hosted MCP servers face a choice between operator allowlists that block custom agents and open registration that lets a fake client harvest an authorization code in one click. Stream Vessel's per-user trusted redirect list, decided at authorize time with a typed host, an email alert and revocation on removal, offers another approach for MCP operators. Alexander Loginov published Stream Vessel's account of the design on November 4th, 2026 https://streamvessel.com/blog/mcp-trusted-redirect-uris?ref=runtimewire . Stream Vessel published its account of the design on November 4th; it did not specify a feature rollout date.… When you purchase through links in our articles, we may earn a small commission https://runtimewire.com/affiliate-monetization-standards . This doesn’t affect our editorial independence.