All updates

August 30, 2026

Tighten MCP token signing and refresh replay

MCP access-token signing now requires its dedicated signing secret.

Read more
  • The app handoff secret can no longer mint or verify access tokens. Without the dedicated secret, access-token handling fails closed.
  • Concurrent refresh replay capacity resets after the active 60-second window, preserving the five-replay bound for later bursts.
  • Bounded replay grace can recover a lost refresh response and uses one replay slot.
  • The OAuth contract does not promise deterministic, identical token re-serving.

See how Outcomet works.

Follow a customer problem from feedback to a product decision.

See how it works
August 30, 2026 | Outcomet