MCP-server with password made in Brazil

[marioluciofjr]

Pre-submission Checklist

• I have verified that this discussion would not be more appropriate as an issue in a specific repository
• I have searched existing discussions to avoid duplicates

Discussion Topic

Hi, everyone!

I'm introducing my latest mcp-server, which allows you to search for news on the web within the free Claude Desktop, but with one caveat: the user must have a password.

In other words, I created my first mcp that requires a password, making it possible to have MCPs that can be exclusive.

You can check the documentation here: https://github.com/marioluciofjr/mcp_news
Discuss the project here: https://talktogithub.com/marioluciofjr/mcp_news
And see a complete tutorial of the documentation here: https://code2tutorial.com/tutorial/a67c8977-c7d2-49de-8374-c601a2893a00/index.md

[olaservo]

Hi @marioluciofjr, your server example and tutorial seems to be demonstrating a few security anti-patterns that should not be used in real implementations, e.g. passing a password in plain text in your tool parameters and your prompts.

MCP security guidelines for the latest released version: https://modelcontextprotocol.io/specification/2025-03-26/basic/authorization#1-2-protocol-requirements

[marioluciofjr]

Thank you for the correction, @olaservo. So, you recommend that the password should not be passed as plain text and, when it is used as an argument, it should not be categorized as a string, right?

How would you recommend I set it in the argument? Could you kindly give me an example?

Thank you for the tips in advance.

[olaservo]

@marioluciofjr since these types of concerns aren't really specific to MCP, I'd recommend checking something out like OWASP's secure development guidance: https://owasp.org/www-project-developer-guide/