01
MCP OAuth Framework
An OAuth 2.0 framework for protecting MCP servers. Ships as three pip-installable packages: auth server, resource server, and a runnable example.
Authorization server with PKCE, dynamic client registration, and RFC 6749 errors
01 / AI agent security
Research index · Dropbox
Brooks McMillin
Secure AI systems by designing for what happens when the model is wrong.
I lead AI agent security work at Dropbox and build public tools, research, and writing about what holds up in practice.
02
Selected evidence
Specific work is a better authority claim than a credential.
02
TaskManager
A task manager built around a real OAuth 2.0 auth server. Includes a Python SDK and MCP server, so my AI agents can manage tasks too.
Full OAuth 2.0 authorization server with PKCE support
03
SMS Communications Suite
Send and receive SMS through GSM modems. Includes CLI tools and libraries in both Go and Python.
Cross-platform GSM modem interface (Go + Python)
How the security work holds together
An agent request moves through a tool call, an authorization boundary, and an audit trail before it can have an effect.
agent tool call authorization boundary audit trail
03
Writing
A Coding Agent Read a File That Didn't Exist Five Times, Then Blamed the Tools
A Claude Code session confabulated a nonexistent Python file, persisted against five truthful "does not exist" errors, then self-diagnosed as corrupted tool output. A reconstruction from the raw transcript, a corpus scan across 3,001 sessions on whether the failure is worse in Opus 4.8, and a model-independent mitigation.
05
Personal
Outside the day job, I write, contribute to open-source security tooling, and stay active in the Bay Area security community. If you've read something here and want to push back or trade notes, I'd rather hear it than not.
More about my background and approach06
Contact
For a conversation, collaboration, speaking invitation, or focused security review, send a note. Consulting details live on the work page; there is no pitch required.