Integrating AI agents into existing products is shifting from building custom assistants to exposing robust APIs via the Model Context Protocol (MCP). A new deep-dive guide from developer Angojay details the architectural decisions required to build remote MCP servers using NestJS, focusing on the practicalities of OAuth 2.1 and dynamic client registration. The post argues that instead of forcing users to leave their preferred agent environments like Cursor or Claude, developers should expose their product's capabilities as tools that agents can plug into directly.

Architecture and Authentication

The guide emphasizes a three-layer architecture: Auth, MCP endpoint, and Domain services. Crucially, business logic remains isolated in domain services, with the MCP route acting merely as an authenticated API surface. For remote servers, the standard is OAuth 2.1 with Proof Key for Code Exchange (PKCE), replacing brittle API keys. This approach allows for short-lived tokens, per-agent revocation, and explicit user consent screens. The implementation relies on publishing protected resource metadata (RFC 9728) and authorization server metadata (RFC 8414) to help hosts automatically discover authentication endpoints.

Dynamic Client Registration and Security

Dynamic Client Registration (DCR) is highlighted as essential for allowing new agents to connect without pre-registration. The guide warns about redirect URI validation, noting that allowing only HTTPS or specific loopback addresses is critical to preventing OAuth bugs. Security extends to the tool design itself; the author advocates for scoped tool registration, where tools are not even listed if the user hasn't granted the corresponding scope. This prevents agents from attempting unauthorized actions. Furthermore, the guide details handling race conditions between agent and user edits using optimistic locking with version numbers, ensuring data integrity when concurrent changes occur.

Testing and Best Practices

Before deploying to production, the guide recommends using the official MCP Inspector to validate the server's behavior. Key testing scenarios include verifying that unauthenticated calls trigger the correct 401 response with WWW-Authenticate headers, and confirming that tool listings respect granted scopes. The author also stresses the importance of treating tool outputs as untrusted input to mitigate prompt injection risks. Recommendations include using reversible actions like archiving instead of hard deletes, and rigorously validating token audiences to prevent the 'confused deputy' problem where one service's token is mistakenly accepted by another.

Key Takeaways

  • Remote MCP servers should use OAuth 2.1 with PKCE instead of long-lived API keys for better security and revocation control.
  • Implement Dynamic Client Registration (DCR) to allow new AI agents to connect without manual client ID provisioning.
  • Scope tool visibility based on user grants; if a user lacks write permissions, write tools should not appear in the tool list.
  • Validate token audiences strictly to ensure tokens issued for one resource are not accepted by another.

The Bottom Line

The era of bespoke AI assistants is ending; the future is interoperable agents that plug into your data via standardized protocols like MCP. Get the auth and security right, or your agent will leak your data.