MCP Dev Summit Mumbai 2026

ost MCP servers today ship with a simple setup: plug in an API key or a shared credential, and you're good to go. That works fine for a weekend hack, but the moment you bring MCP into an enterprise, things start to fall apart. You don't want MCP clients storing static usernames and passwords — that's a security incident waiting to happen. You can't tell who did what, you can't enforce fine-grained access control, and your security team is not going to be happy. What enterprises actually need is for users to authenticate through their existing SSO, get access to MCP servers based on who they are and what they're allowed to do, and have every action tied back to a real identity for audit and compliance.

In this talk, we use the OpenSearch MCP Server as a concrete example to show why this matters and what we can do about it. We'll walk through extending the server to support OAuth 2.0 Authorization Code Flow with PKCE and Dynamic Client Registration (DCR), following the MCP authorization spec.