refactor: reorganize security docs into more logical locations

Move security research program to resources/ and dissolve the guides/security
section, placing the MCP server security guides under guides/create-tools/secure-your-server.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: EricGustin

app/en/get-started/agent-frameworks/vercelai/page.mdx

@@ -597,7 +597,7 @@ On first use, you'll see an authorization button. Click it to connect your Gmail
 ## Next steps
 
 1. **Add more tools**: Browse the [MCP server catalog](/resources/integrations) and add tools for GitHub, Notion, Linear, and more.
-2. **Add user authentication**: In production, get `userId` from your auth system instead of environment variables. See [Security](/guides/security) for best practices.
+2. **Add user authentication**: In production, get `userId` from your auth system instead of environment variables. See [Secure your server](/guides/create-tools/secure-your-server) for best practices.
 3. **Deploy to Vercel**: Push your chatbot to GitHub and [deploy to Vercel](https://vercel.com/docs/deployments/overview) with one click. Add your environment variables in the Vercel dashboard.
 
 ## Complete code

app/en/guides/_meta.tsx

@@ -19,9 +19,6 @@ export const meta: MetaRecord = {
   "deployment-hosting": {
     title: "Deployment & hosting",
   },
-  security: {
-    title: "Security & Compliance",
-  },
 };
 
 export default meta;

app/en/guides/create-tools/_meta.tsx

@@ -16,6 +16,9 @@ export const meta: MetaRecord = {
     title: "Handle errors",
     href: "/guides/create-tools/error-handling",
   },
+  "secure-your-server": {
+    title: "Secure your server",
+  },
   "migrate-toolkits": {
     title: "Migrate from toolkits to MCP servers",
   },

app/en/guides/security/_meta.tsx …reate-tools/secure-your-server/_meta.tsxapp/en/guides/security/_meta.tsx renamed to app/en/guides/create-tools/secure-your-server/_meta.tsx app/en/guides/security/_meta.tsx renamed to app/en/guides/create-tools/secure-your-server/_meta.tsx

@@ -11,14 +11,8 @@ const meta: MetaRecord = {
   index: {
     title: "Overview",
   },
-  "securing-arcade-mcp": {
-    title: "Securing Arcade MCP",
-  },
   "secure-your-mcp-server": {
-    title: "Secure your MCP server",
-  },
-  "security-research-program": {
-    title: "Security research program",
+    title: "Add Resource Server auth",
   },
 };
 

…es/security/securing-arcade-mcp/page.mdx …create-tools/secure-your-server/page.mdxapp/en/guides/security/securing-arcade-mcp/page.mdx renamed to app/en/guides/create-tools/secure-your-server/page.mdx app/en/guides/security/securing-arcade-mcp/page.mdx renamed to app/en/guides/create-tools/secure-your-server/page.mdx

@@ -21,8 +21,4 @@ This approach is ideal when:
 
 Resource Server auth works alongside tool-level authorization. Resource Server auth secures access to the MCP server itself, while tool-level auth enables your tools to access third-party APIs on behalf of the authenticated user.
 
-Learn more about adding front-door OAuth to your MCP server [here](/guides/security/secure-your-mcp-server).
-
-### Client ID Metadata Documents (Coming soon)
-
-Coming soon, you will be able to secure your MCP server using Client ID Metadata Documents (CIMD) for authorization. Learn more about how MCP integrates with OAuth [here](https://blog.modelcontextprotocol.io/posts/client_registration/).
+Learn more about adding front-door OAuth to your MCP server [here](/guides/create-tools/secure-your-server/secure-your-mcp-server).

…security/secure-your-mcp-server/page.mdx …r-server/secure-your-mcp-server/page.mdxapp/en/guides/security/secure-your-mcp-server/page.mdx renamed to app/en/guides/create-tools/secure-your-server/secure-your-mcp-server/page.mdx app/en/guides/security/secure-your-mcp-server/page.mdx renamed to app/en/guides/create-tools/secure-your-server/secure-your-mcp-server/page.mdx

@@ -17,7 +17,7 @@ Arcade MCP servers support two distinct layers of authorization that work togeth
 
 ## Quick Comparison
 
-| Aspect                | [Resource Server Auth (Front-Door)](/guides/security/secure-your-mcp-server) | [Tool-Level Authorization](/guides/create-tools/tool-basics/create-tool-auth) |
+| Aspect                | [Resource Server Auth (Front-Door)](/guides/create-tools/secure-your-server/secure-your-mcp-server) | [Tool-Level Authorization](/guides/create-tools/tool-basics/create-tool-auth) |
 | --------------------- | ---------------------------------------------------------------------------- | ----------------------------------------------------------------------------- |
 | **What it secures**   | Access to your MCP server                                                    | Access to third-party APIs                                                    |
 | **Who authenticates** | The user calling your server                                                 | The user's access to external services                                        |

app/en/guides/security/page.mdx

@@ -125,7 +125,7 @@ _Here's what's new at Arcade.dev!_
 
 **Arcade MCP Servers**
 
-- `[feature - 🚀]` OAuth authentication for `arcade-mcp` servers. Learn more about it [here](/guides/security/secure-your-mcp-server!
+- `[feature - 🚀]` OAuth authentication for `arcade-mcp` servers. Learn more about it [here](/guides/create-tools/secure-your-server/secure-your-mcp-server!
 - `[maintenance - 🔧]` Ability to run multiple uvicorn workers
 - `[maintenance - 🔧]` Include type annotations for `arcade_mcp_server`
 

app/en/learn/server-level-vs-tool-level-auth/page.mdx

@@ -16,6 +16,9 @@ export const meta: MetaRecord = {
   faq: {
     title: "FAQ",
   },
+  "security-research-program": {
+    title: "Security research program",
+  },
   "contact-us": {
     title: "Contact",
   },