Endram field guides
AI agent policy templates
Copyable starting policies for production actions, with rollout and evidence guidance.
MCP protocol reference
MCP protected resource metadata (RFC 9728)
The exact protected resource metadata document, WWW-Authenticate challenge, and discovery path an MCP server needs so a client can find its authorization server without configuration.
Open guide →02 · mcp dynamic client registrationMCP dynamic client registration without a shared secret
How an MCP server accepts RFC 7591 registration from clients it has never met, which fields to reject, and why the only safe answer for a desktop agent is a public PKCE client.
Open guide →03 · rfc 8707Binding MCP tokens to one server with resource indicators (RFC 8707)
How the resource parameter stops a token minted for one MCP server from working against another, with the exact authorization and token requests and the server-side check that makes it real.
Open guide →04 · mcp token passthroughMCP token passthrough and the confused deputy
Why forwarding a client's token to an upstream API is explicitly disallowed by the MCP specification, what breaks when you do it, and the exchange pattern that replaces it.
Open guide →05 · mcp streamable httpSecuring MCP Streamable HTTP transport
The transport-level checks a Streamable HTTP MCP server needs: Origin validation, local binding, session handling, and what changed when SSE became a response mode instead of a transport.
Open guide →06 · mcp session idMCP session ID: what it is for and what it must never be
How the Mcp-Session-Id header is issued, carried, and terminated, why it is not an authentication credential, and the failures that follow from treating it as one.
Open guide →07 · mcp elicitationMCP elicitation: what to allow a server to ask a user for
Elicitation lets an MCP server request input from the human mid-call. The controls that matter are what may be asked, what the answer is allowed to change, and why an elicited answer is not an approval.
Open guide →08 · mcp samplingMCP sampling: letting a server borrow your model safely
Sampling lets an MCP server ask the client to run a model completion. The controls are cost, prompt provenance, and making sure a server-authored completion never becomes an authorization decision.
Open guide →09 · oauth token exchangeOAuth token exchange for agent delegation (RFC 8693)
The request and response shape for exchanging a user's token for a narrow downstream token an agent can use, and the claims that keep the human visible on the other side.
Open guide →Implementation and testing
MCP server security checklist
A production-ready starting policy for mcp server, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →02 · mcp server examplesMCP server examples with security policy
A production-ready starting policy for mcp server examples, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →03 · mcp server authenticationMCP server authentication checklist
A pass or fail checklist for authenticating a remote MCP server: discovery, registration, PKCE, audience binding, scope enforcement, revocation, and the tests that prove each one.
Open guide →04 · mcp tool poisoningMCP tool poisoning and description drift
Tool descriptions are model-visible instructions. This is how a server changes them after approval, why the client cannot see it, and the pinning and diffing controls that catch it.
Open guide →05 · fastmcp authFastMCP authentication for a remote server
What a FastMCP server has to expose before an external client can authenticate to it, which parts FastMCP gives you, and which parts remain your authorization server's job.
Open guide →06 · mcp remoteConnecting a client to a remote MCP server with mcp-remote
The bridge that lets a stdio-only MCP client reach an OAuth-protected remote server, the config that works, and the failures that come from stale credentials rather than from your server.
Open guide →07 · mcp inspectorTesting an authenticated MCP server with MCP Inspector
How to use Inspector to prove that discovery, the OAuth flow, scopes, and audience binding actually work on your MCP server, instead of testing only the tools.
Open guide →08 · langgraph human in the loopLangGraph human-in-the-loop approval that survives a restart
How interrupt and Command resume a LangGraph run for human review, why the checkpointer is the part that matters, and where the approval decision should actually live.
Open guide →MCP policy templates
MCP tool allowlist policy
A production-ready starting policy for mcp tool allowlist, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →02 · mcp resource allowlistMCP resource allowlist policy
A production-ready starting policy for mcp resource allowlist, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →Action policy templates
GitHub merge approval policy
A production-ready starting policy for github ai agent approval, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →02 · ai agent deployment approvalProduction deployment approval policy
A production-ready starting policy for ai agent deployment approval, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →03 · ai agent refund approvalAgent refund threshold policy
A production-ready starting policy for ai agent refund approval, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →04 · ai agent database access policyAI agent database write policy
A production-ready starting policy for ai agent database access policy, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →05 · ai agent email approvalAI agent external email policy
A production-ready starting policy for ai agent email approval, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →06 · ai agent slack policyAI agent Slack announcement policy
A production-ready starting policy for ai agent slack policy, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →07 · ai agent kill switchAI agent emergency kill switch policy
A production-ready starting policy for ai agent kill switch, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →Delegation and credentials
Verified AI agent identity policy
A production-ready starting policy for verified ai agent identity policy, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →02 · ai agent delegation policyDelegated AI agent task policy
A production-ready starting policy for ai agent delegation policy, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →03 · task scoped credentials githubTask-scoped GitHub credential policy
A production-ready starting policy for task scoped credentials github, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →04 · one time access token ai agentOne-use AI agent grant policy
A production-ready starting policy for one time access token ai agent, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →05 · purpose bound access policyPurpose-bound AI agent access policy
A production-ready starting policy for purpose bound access policy, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →06 · expiring agent delegationExpiring AI agent delegation policy
A production-ready starting policy for expiring agent delegation, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →07 · ai agent least privilege policyAI agent least-privilege review policy
A production-ready starting policy for ai agent least privilege policy, including match conditions, approval behavior, evidence, and rollout checks.
Open guide →