SqlOS 7.1: MCP is a resource, not a package
SqlOS declares the MCP audience. Microsoft's SDK hosts the server. SqlOS.Mcp is gone.
AuthServerOAuthMCPSqlOS
Read the postBlog
Blog
Auth, hierarchical authorization, EF Core, and practical .NET application security — release by release.
SqlOS 7.0: Lock Routes with RequireAuthorization
SqlOS is an auth server, not an API gateway. AddSqlOS registers a JWT scheme; your app locks routes with ordinary ASP.NET.
AuthServerOAuthMCPSecuritySqlOS
Read the postSqlOS 6.0: One Call Is the Only Call
MapSqlOS, RequireSqlOSAccessToken, and UseSqlOSAccessTokenValidation are gone. Describe the application once; mapped endpoints under Api and Mcp are already protected.
AuthServerOAuthMCPSecuritySqlOS
Read the postSqlOS 5.0: One Call, Two Databases
Describe your application once in AddSqlOS and SqlOS derives the routes, token validation, metadata, client, and MCP server; run the same host on SQL Server or PostgreSQL; and logout now revokes the whole issuer session, not one cookie.
AuthServerOAuthMCPPostgreSQLSecuritySqlOS
Read the postSqlOS 4.2: Your Login Screens, Our State Machine
@sqlos/headless is a typed client for SqlOS's headless AuthPage. Draw sign-in, signup, MFA, and consent in Next.js, Angular, or Expo; SqlOS keeps every security decision and stops at an authorization code.
AuthServerOAuthHeadlessSqlOS
Read the post