# Security and identity

Essays and notes tagged Security and identity.

- [Designing an enterprise MCP registry: the control point agents need](https://muthub.org/writing/designing-an-enterprise-mcp-registry.md) (Sep 18, 2025): As agents multiply, every enterprise needs an authoritative directory of the tools they can call. What a governed MCP registry must do, what the official registry leaves to you, and the mistakes to avoid.
- [Securing AI agents: identity, not secrets](https://muthub.org/writing/securing-ai-agents-identity-not-secrets.md) (May 29, 2025): Agents act on their own, at machine speed, across many systems. Static credentials and perimeter thinking don't hold up. Attested identity, explicit delegation and policy enforced outside the model do.
- [Adopting MCP in a bank: the four risks to solve first](https://muthub.org/writing/adopting-mcp-in-a-bank.md) (Apr 22, 2025): The Model Context Protocol standardizes how agents connect to tools and data. It is silent on whether they should. Four risk areas a regulated institution should resolve before agents get tools.
- [The MCP spec grows up](https://muthub.org/writing/the-mcp-spec-grows-up.md) (Apr 1, 2025): OAuth 2.1 authorization, streamable HTTP, batching and tool annotations: the March 2025 update that made enterprise MCP plausible.

---
Muthukrishnan (Muthu) Bommiah · https://muthub.org · Views are my own and do not represent my employer.