ai-agents
Articles tagged with ai-agents.
CVE-2026-59822: LiteLLM's MCP Auth Bypass, and the Second Bug in the Same Fix
CVE-2026-59822 let any fabricated Bearer token open a LiteLLM MCP session. The two separate bugs one pull request closed, and…
11 min readAgentic Commerce Authentication: Tokens vs Payment Mandates
AI shopping agents need two separate proofs: a token saying who acts for whom, and a signed mandate saying what…
9 min readOkta Managed MCP Server vs Keycloak for Conversational IAM
Okta's hosted MCP server lets you administer your org in natural language. Here is what it does, and how the…
9 min readKeycloak CIMD for MCP: Client ID Metadata Documents for Claude Code and VS Code
Keycloak has shipped experimental CIMD support since 26.6 behind the cimd flag. Here is the client policy that lets Claude…
11 min readAgentic IAM in September 2026: What Okta Agent SSO, Ping, and JumpCloud Mean If You Run Keycloak
Okta, Ping and JumpCloud all shipped agentic IAM in the last three weeks. Here is what those launches actually add,…
11 min readStateless MCP: What the 2026-07-28 Spec Changes for Tool Builders
MCP went stateless in the 2026-07-28 spec: no initialize handshake, no Mcp-Session-Id. Here is what changes for MCP servers and…
10 min readCross-App Access (ID-JAG) for AI Agents, and Where Keycloak Stands
Cross-App Access (ID-JAG) lets your identity provider broker scoped API access for AI agents instead of per-app consent and refresh-token…
6 min read
Keycloak DCR for MCP Servers: Setup with VS Code
Set up Keycloak Dynamic Client Registration (DCR) so MCP clients such as VS Code can register themselves, with Trusted Hosts,…
12 min read
Authenticating AI Agents with Keycloak: OAuth 2.0 for LLM Apps
Learn how to authenticate AI agents and LLM-powered applications with Keycloak using OAuth 2.0 client credentials, scoped tokens, and MCP…
9 min readStay ahead on identity & security
Get tutorials, product updates, and Keycloak tips delivered to your inbox.