# Stream Vessel lets users authorize their own agent callback addresses

_Published Wednesday, November 4, 2026 at 12:27 PM EST · Security · Latest · Tier 2 — Notable_

![Stream Vessel lets users authorize their own agent callback addresses — Primary](https://streamvessel.com/images/blog/mcp-trusted-redirect-uris/social.png)

Stream Vessel says it has shipped controls that let users connect their own agents to its storage service without asking the operator to expand a shared list of trusted callback addresses. Each account can trust up to 10 exact HTTPS addresses for receiving authorization responses.

The service checks trust after sign-in and refuses to redirect codes or errors to untrusted addresses. Adding an address requires the user's browser session and typed confirmation of the host; removing one revokes associated grants and unexchanged codes. The company dropped a restriction on delete access, and acknowledges that users persuaded to trust an attacker's address can still be phished.

## Sources

- [streamvessel.com](https://streamvessel.com/blog/mcp-trusted-redirect-uris)

---
Canonical: https://techandbusiness.org/newswire/qhTkSQCwtjgH5yDuBiheXB
Published: 2026-11-04T17:27:33.856Z
Story chronology: 2026-11-04T00:00:00.000Z
Retrieved: 2026-11-04T22:01:08.871Z
Publisher: Tech & Business (techandbusiness.org)