Developers using the Model Context Protocol (MCP)—a standard for connecting AI models to external data sources—often face a dilemma when building custom agents. To connect an agent to a service like an S3 bucket, the developer must use OAuth authentication. However, many MCP servers only allow redirect URIs from a pre-approved list of well-known applications like Claude or VS Code. If a server refuses these custom addresses, developers are forced to use insecure methods; if it accepts any address provided during anonymous registration, it opens a significant phishing hole.
When an authorization server accepts arbitrary redirect URIs, attackers can register a fake client with a name like "Claude" and set their own malicious URL as the callback point. A user who clicks a link to "reconnect storage" would see a legitimate consent screen on the real domain but unknowingly send their one-time authorization code directly to the attacker's site. Evidence of this vulnerability is widespread: a May 2026 study found that nearly 96% of tested MCP servers accepted arbitrary redirects from anonymous requesters. Real-world instances have already resulted in compromised merchant profiles and bank details due to such flaws.
To solve this, Stream Vessel introduces a design where trust is determined per user at the moment of sign-in rather than at initial registration. While the server still allows any URI to be registered anonymously (to accommodate diverse clients), it will only execute a redirect if the host is on a global allowlist, a loopback address (like localhost), or a personal list managed by the specific signed-in user. To defend against social engineering—where a user might be tricked into manually adding an attacker’s host—the system requires users to type out the host address as plain text before it is added to their trusted list. This creates deliberate friction, supported by automated audit emails and a default 'read-only' permission state for newly trusted addresses, ensuring that even if a user is deceived, the blast radius remains limited.
This diagram explains the logic flow where the server evaluates the redirect URI against different trust levels (global, loopback, or personal) to decide whether to proceed with the authorization.
This image illustrates the security mechanism where users must provide plain text input to authorize a new host, as described in the final paragraph.