---
format: "aidr-story-markdown/v1"
id: "d14a1b8f436a04340a47092c8957af3a7ae503857910b135b7ccb18b3112cf64"
canonical_url: "https://aidr.today/d14a1b8f?lang=en"
title: "Letting users trust their own MCP clients, without opening a phishing hole"
lang: "en"
requested_lang: "en"
available_langs: ["en","vi"]
translation_fallback: null
fallback_fields: []
published_at: "2026-11-04T15:30:57.000Z"
category: "Frameworks"
topics: ["safety","framework"]
source_urls: ["https://streamvessel.com/blog/mcp-trusted-redirect-uris","https://news.ycombinator.com/item?id=50367004"]
summary: "Per-user trusted redirect URIs decided at sign-in allow MCP servers to accept custom clients without opening a phishing hole."
---

# Letting users trust their own MCP clients, without opening a phishing hole

> [Open the canonical story](<https://aidr.today/d14a1b8f?lang=en>)

**Published:** 2026-11-04T15:30:57.000Z
**Category:** Frameworks
**Topics:** safety, framework

## Summary

Per\-user trusted redirect URIs decided at sign\-in allow MCP servers to accept custom clients without opening a phishing hole\.

## Sources

- [Story source](<https://streamvessel.com/blog/mcp-trusted-redirect-uris>)
- [Discussion](<https://news.ycombinator.com/item?id=50367004>)