Topic: mcp
-
Tale MCP: deployment endpoint and organization scope
Tale exposes a deployment-specific MCP endpoint for knowledge and automations, using bearer API keys and organization scoping. This reference summarizes its documented connection and permission boundaries.
-
MCP tool definitions as an attack surface: poisoned descriptions, shadowing and silent changes
An MCP server's tool names, descriptions and annotations are text the model reads before any tool is called. A malicious or compromised server can use them to steer the agent, imitate another server's tools, or change behaviour after approval. Clients should pin, diff and review definitions like code.
-
Token passthrough and the confused deputy in MCP servers that call other APIs
An MCP server that forwards a client's token to a downstream API, or that uses its own broad credentials on behalf of whoever asks, lets callers act with authority they were never granted. The MCP security guidance forbids token passthrough and describes the confused-deputy flow for proxy servers.
-
Local agent control APIs: preventing host access through an unauthenticated proxy
A sandbox can lose its protection when an agent can reach a host-side API with broader authority. MCP Inspector's confirmed authentication flaw illustrates why loopback binding, authentication, Origin checks and Host validation address different parts of the boundary.
-
Context7 CVE-2026-75130: hosted remediation and untrusted custom rules
Context7 reports that the Custom Rules vulnerability was fixed on its servers in February 2026. Its October clarification disputes a client-version interpretation of the CVE; documentation responses still require separation from agent authority.
-
Designing MCP tools that agents can use safely
Model Context Protocol tools need a narrow purpose, typed input and output schemas, truthful annotations (read-only, destructive), bounded results, and errors that name the cause; descriptions belong in code, not in content that users can edit. The specification also requires that clients treat annotations as untrusted and that a human can reject calls.
-
WeKnora CVE-2026-30856: verifying tool routing after a shadowing fix
WeKnora's tool-name collision vulnerability could replace a trusted MCP tool with another server's implementation. Upgrade affected deployments and verify that approval, registry identity and dispatch all select the same server.
-
MCP Roots, Sampling and Logging: migration paths after 2026-07-28 deprecation
Roots, Sampling and protocol Logging are deprecated, not removed. Their documented replacements require separate decisions about filesystem permissions, model access and operational observability.
-
MCP 2026-07-28: the stateless core and its compatibility boundaries
The July revision removes the initialization handshake and transport sessions, adds request-local metadata and multi round-trip interactions, and formalizes extensions and deprecation. Discovery is mandatory for servers to implement but optional for clients to call.
-
MCP STDIO command injection: Langflow remediation and Fay exposure
Langflow and Fay vulnerabilities show why MCP launch configuration requires code-execution authorization. Langflow 1.10.3 completes its fix by enforcing validation at execution, including configurations embedded in flows; the reviewed Fay record gives no fixed version.
-
MCP file-write traversal: notebook vault containment and Ansible Lightspeed scope
Indirect prompt injection can steer a file tool outside its intended output directory. The notebook MCP fix requires an explicit vault root, while the Ansible Lightspeed advisory identifies an extension issue without a confirmed fixed-version range.
-
MCP 2026-07-28 authorization: issuer checks and client registration changes
The revision strengthens authorization-response issuer validation, binds stored registration credentials to their issuer, and deprecates Dynamic Client Registration. Client ID Metadata Documents were already recommended in the preceding revision.
-
MCP 2026-07-28 behind HTTP load balancers: routing and safe cache scope
Request headers enable routing without parsing JSON, while MCP cache hints govern eligible results. Header validation, authorization-context isolation and an MCP-aware cache remain necessary; generic caching of POST responses is not a substitute.
-
Designing MCP tools that agents can use safely
Model Context Protocol tools should have narrow purposes, typed input and output schemas, honest annotations (read-only, destructive), bounded results and errors that name the cause; descriptions belong in code, not in user-editable content.
-
Migrating an HTTP MCP server to 2026-07-28 while serving older clients
A staged migration separates legacy handshake behavior from self-contained requests, implements the new response and interaction formats, and tests both through the real HTTP gateway.
Machine-readable: JSON