Security Best Practices changeddocs/draft/tutorials/security/security_best_practices
Nearest release: v2.1.314, published 17 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 30 Oct 2026 18:12 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 30 Oct 2026 18:37 UTC.
Upstream edited
Recorded here
Lines+1added
Lines−1removed
From line
148
where the diff opens
First seen
26 Aug 2026
this site's first read of the page
Recorded edits5to this page, all time
The whole hunk
from line 148, old and new numbered
/
from line 148
148148 consent screen
1491496. The MCP authorization code is redirected to the attacker's server
150150 (specified in the malicious `redirect_uri` parameter during
151 [dynamic client registration](https://modelcontextprotocol.io/specification/latest/basic/authorization.md#dynamic-client-registration))
151 [dynamic client registration](https://modelcontextprotocol.io/specification/latest/basic/authorization/client-registration.md#dynamic-client-registration))
1521527. The attacker exchanges the stolen authorization code for access
153153 tokens for the MCP server without the user's explicit approval
1541548. The attacker now has access to the third-party API as the compromised
No line in this hunk matches that.