MCP Auth Gets Real: What the 2026-07-28 Spec Means for Local MCP Servers Behind a TunnelAuthentication is the part of MCP that tends to get postponed. A May 2026 measurement study put it plainly: many remote servers treat it as a deployment add-on rather than a security boundary. The 20213h ago · 18 min readinstatunnel.hashnode.dev
After the Quick Tunnels Moment: What Account-Less Tunnels Get Right, and Where They StopOn September 18, 2026, a link to Cloudflare’s Quick Tunnels page climbed to the top of Hacker News, collecting more than 800 points and 300 comments, according to Cloudflare’s own write-up. Two weeks 1d ago · 13 min readinstatunnel.hashnode.dev
Stripe Thin Events on Localhost: When the CLI Is Enough and When You Need a Stable Public URLIf you wrote your Stripe webhook handler a few years ago, it probably assumes the event contains the whole object. Thin events break that assumption on purpose. A thin event is a small notification th2d ago · 16 min readinstatunnel.hashnode.dev
Cookies on Tunnel Domains: Why Login Works on localhost but Breaks on a Tunnel URLYou build a login flow, test it on localhost:3000, and it works. Then you expose the app through a tunnel to demo it, test OAuth, or open it on a phone. The login form submits, the server returns 200,3d ago · 15 min readinstatunnel.hashnode.dev
Chrome’s Local Network Access Prompt: What Breaks for Localhost Dev (and When a Tunnel Is the Wrong Fix)If a hosted frontend suddenly can’t reach your localhost:8080 API in Chrome, you have almost certainly met Local Network Access (LNA). Since Chrome 142, requests from public websites to local and loop4d ago · 13 min readinstatunnel.hashnode.dev
