A service account has admin access and no tenant context. This post shows the OAuth 2.1 flow that makes Claude authenticate as the real user: discovery endpoints, mock Dynamic Client Registration, JWT validation, and bearer token forwarding. (Claude's random callback ports get their own post — Series 2B.)
Posted in Development, AI, MCP, .NET, Security on July 2, 2026 by ‐ 16 min read
The Inspector proves your protocol; only Claude proves your product. This post builds the bridge middleware that lets real Claude Code authenticate — random localhost ports and all — so the client that hits a tool error is the same agent that reads your code and fixes it.
Posted in Development, AI, MCP, .NET, Security on July 2, 2026 by ‐ 13 min read
Every caching tutorial ends up polluting the application layer with GetAsync, SetAsync, and RemoveAsync. This post shows a different approach: a decorator that intercepts at the DI layer, version-based ETags that validate client caches without a round trip to the database, and why Redis becomes optional once you get the defaults right.
Posted in Development, .NET, ABP Framework, Architecture on June 28, 2026 by ‐ 16 min read
Most MCP tutorials show stdio — a local process Claude talks to directly. That works on your laptop, but it's not deployable. Here's how to build an MCP server in ASP.NET Core that runs over HTTP, where the tools, the transport, and the deployment story all actually make sense.
Posted in Development, AI, MCP, .NET on June 18, 2026 by ‐ 8 min read