Security & Trust
Audience-Bound Credentials: The allowed_hosts Pattern for MCP Agents
Handing an agent an API key is handing it to every host the agent can reach. Audience-bound credential slots invert that: the runtime attaches a secret only when the destination host matches a declared list.
Kata Team11 min