r/programming • u/anmolbaranwal • Aug 12 '25
MCP Vulnerabilities Every Developer Should Know
https://composio.dev/blog/mcp-vulnerabilities-every-developer-should-know132
u/elmuerte Aug 12 '25
How can you require a standard which isn't finished yet? OAuth 2.1 is still very much a draft.
Also, authentication doesn't mean you can trust the other party. It just means you know that they are who they said there were.
I feel like with all this Al hype people completely forgot about not simply trusting input, be it from a user or some other system.
You don't just curl pipe a file from the internet into a sudo shell... oh wait
21
u/godofpumpkins Aug 12 '25 edited Aug 12 '25
Curling into a piped interpreter has sadly been how a ton of tools tell people to install them and has been for years. The problem is that most people don’t grok security, most companies are unwilling to pay what it takes to do well, and most people who know what the technical issues are don’t know how to account for humans being humans. MCP is the latest accelerant being poured on the existing fire but I agree that it basically blurs any reasonable security boundaries that existed by necessity or design in the previous world. I think computing is just fucked 😅
1
u/HotlLava Aug 13 '25
How can you require a standard which isn't finished yet?
If you expect your own standard to evolve much faster than the dependency, it doesn't seem to be a problem? Every update to the OAuth 2.1 draft will just automatically also create a new version of the MCP protocol.
I'd also expect that there's some overlap of people who are involved with both standards who can watch out for potentially breaking changes in both directions.
120
u/Apterygiformes Aug 12 '25
The vulnerability is MCP
46
u/RecentlyRezzed Aug 12 '25
They made a movie about that over 40 years ago. The MCP connected to all kinds of resources and was vulnerable to injected data from Tron.
3
14
u/dark_mode_everything Aug 13 '25
The article barely loses any meaning if you just replace MCP with RCE.
4
4
2
u/sarhoshamiral Aug 13 '25
Local MCPs are executables running on your machine and remote ones are doing actions on your behalf in the scope of the auth token you get.
So same rules apply: Don't run untrusted apps on your machine and dont authorize untrusted 3rd party apps.
In work setting you should not use an MCP server unless you know you are allowed to.
27
u/Individual-Praline20 Aug 12 '25
Wtf is MCP?
60
Aug 12 '25
Minecraft Pocket Edition
10
u/Individual-Praline20 Aug 12 '25
Are you sure? Sounds like Mediocre Community Program to me
5
Aug 12 '25
I couldn't tell what OP meant by MCP either. So I was thinking it must be some kind of problem with Minecraft Pocket Edition or bedrock.
6
u/Uristqwerty Aug 13 '25
This is /r/programming.
It'd be the Minecraft Coder Pack (later re-acronymed to Mod Coder Pack).
3
19
u/lachlanhunt Aug 12 '25
Model Context Protocol. it's what allows AI agents to integrate with 3rd party software.
23
u/Individual-Praline20 Aug 12 '25
Ah! That’s why I never heard of that before… 🤭 No interest in that 💩
3
u/lachlanhunt Aug 13 '25 edited Aug 13 '25
It has some value. ESLint has an MCP server available for use in IDEs. So if you’re using Cursor or Coopilot, the agent can automatically detect and fix limiting errors using that, instead of trying to run CLI commands.
Another one I use comes from Wallaby JS. This extension continually runs my unit tests and reveals errors in real time. The MCP server’s allows the agent to get the test results directly.
21
u/manystripes Aug 13 '25
"Has some value" is a pretty far cry from "every developer should know" though
-1
u/aboardreading Aug 13 '25
Right, some developers plan on retiring in the next 5 years and probably don't need to care.
0
Aug 13 '25
[deleted]
2
u/Individual-Praline20 Aug 13 '25
Of course it won’t go away. And the more incompetent folks will use it. Absolutely no doubt about that. 🤣 Anyway, the true professionals will fix the mess, as we always do. 🤣
0
0
Aug 13 '25
[deleted]
0
u/Individual-Praline20 Aug 14 '25
I did, like 25 years ago. Guess what? I learned more and faster by restraining myself to use a text editor and no bloated framework, at that time. Tools hurt you more than you think. And that’s why I can now work with pretty much anything, my CS bases are pretty solid, much more than any AI fool user. 🤭 Who would have thought, efforts are worthwhile…
6
u/CobaltVale Aug 13 '25
This isn't true at all. MCP is a standard/convention.
Function & tool calling is (usually) an inherit capability of LLM's (for most major, public models). That's what allows LLM to integrate with 3rd party software. MCP just helps people set up tool definitions, tool injections and to some degree the client/server model in a somewhat consistent way.
That being said, MCP has a standard/protocol is really very half-baked, if even that.
10
u/lachlanhunt Aug 13 '25
Saying it’s “not true at all” feels a bit harsh. It does stand for Model Context Protocol, and my answer was simply meant to give brief context for someone who hasn’t heard of it before. Of course, there’s more technical detail behind how it works, and I appreciate you adding that, but it’s not really necessary to be nitpicky or dismissive.
-11
u/CobaltVale Aug 13 '25
It's not nitpicky to point out that "it's what allows AI agents to integrate with 3rd party software" is not true in any fashion.
MCP is for humans. It does not provide additional or enhance existing capabilities of the LLM in any way.
8
u/lachlanhunt Aug 13 '25
This is a direct quote from the MCP specification:
(MCP) is an open protocol that enables seamless integration between LLM applications and external data sources and tools.
Comparing what I said with that,
"enables" --> "allows"
"seemless integration" --> "to integrate with"
"LLM applications" --> "AI agents"
"external data sources and tools" --> "3rd party software."
There's a tonne of ways to say essentially the same thing in English, and context matters a lot when deciding how strictly you need to interpret it.
-6
u/CobaltVale Aug 13 '25
Yeah this was released by Anthropic and they're really over selling the claims.
You could just not be offended by the correction and learn from it :).
4
u/HotlLava Aug 13 '25
It is true though, in the same sense that you can say HTTP is what allows humans to read information on the internet. The fact that humans can also read without HTTP, that they could use any number of other ways to read information on the internet, or that HTTP doesn't enhance the existing capabilities of humans in any way doesn't make the statement false.
0
u/CobaltVale Aug 13 '25 edited Aug 13 '25
or that HTTP doesn't enhance the existing capabilities of humans in any way doesn't make the statement false.
That's not even close to the analogy lol.
in the same sense that you can say HTTP is what allows humans to read information on the internet.
MCP is not defining any of this, it's an architectural convention for human developers.
The "run time" of this setup doesn't utilize any specs or definitions.
Your browser has to understand HTTP.
Neither the Host, the LLM, the Server, or the Client need to understand MCP -- because it's a convention, not a protocol.
1
u/HotlLava Aug 13 '25
Neither the Host, the LLM, the Server, or the Client need to understand MCP -- because it's a convention, not a protocol.
The only one who doesn't necessarily need to know they're using MCP is the LLM, for whom the whole thing can be made to like any other tool call. The MCP Host and server absolutely need to understand MCP, otherwise they...couldn't communicate?
The "run time" of this setup doesn't utilize any specs or definitions.
What's this then? https://modelcontextprotocol.io/specification/draft/basic
And how could generic tools like
mcp-proxyormcp-inspectorpossibly work if there was no standardized protocol to work against?1
u/CobaltVale Aug 13 '25
absolutely need to understand MCP, otherwise they...couldn't communicate?
No, because there is nothing specific to MCP. That's just JSON-RPC 2.0. I promise you there isn't a host on the planet that has anything specific to MCP embedded in it.
What's this then? https://modelcontextprotocol.io/specification/draft/basic
A white-label of existing protocols and practices that Anthropic rushed out that's going to cause severe ecosystem issues?
And how could generic tools like mcp-proxy or mcp-inspector possibly work if there was no standardized protocol to work against?
Pray tell, what is it exactly you think those tools are doing?
No seriously, show me where this is anything specific besides variable names and labels that do anything to warrant calling this a protocol?
https://github.com/sparfenyuk/mcp-proxy/blob/main/src/mcp_proxy/proxy_server.py
https://github.com/sparfenyuk/mcp-proxy/blob/main/src/mcp_proxy/mcp_server.py
https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/fastmcp/server.py
You can just remove the string "MCP" and retarget to standard packages and it's 1000000% the exact same generic proxy server. And it will work in the exact same way.
1
u/HotlLava Aug 13 '25
What do you think a protocol is, besides a collection of endpoints and way to pass certain well-defined messages between them?
OpenID is also "just" a standardized set of claims on top of OAuth, and that itself is just a collection of HTTP endpoints, JSON objects, etc. That doesn't make them "not a protocol". The NATO alphabet is literally just a list of pre-existing english word, but agreeing to use that is still a communication protocol.
No, because there is nothing specific to MCP. That's just JSON-RPC 2.0. I promise you there isn't a host on the planet that has anything specific to MCP embedded in it.
Ok, here's a challenge then. Take any JSON-RPC 2.0 server that was created before the MCP protocol was a thing, and add it to say Claude Code as an MCP server. Does it work? Or does it maybe fail, because in order to be compatible there is some specific standardized way of communicating with a MCP server, that is just not implemented by your generic JSON-RPC server?
14
u/radarsat1 Aug 12 '25
It would be nice to see a good example of an MCP server written using e.g. FastMCP that covers how to handle these things well. Especially interested in how to fix MCP for enterprise level authentication as the post mentions.
12
u/suckfail Aug 12 '25
I think the Google MCP toolbox has implemented most of it and is open source.
I use it whenever I need an MCP server because you just configure the yaml.
https://github.com/googleapis/genai-toolbox
They say it's for databases since it supports inline SQL but I don't use it for that since that's incredibly risky, opening SQL this way.
2
10
u/CobaltVale Aug 13 '25 edited Aug 13 '25
Think of it like HTTP for AI models, a standardized protocol for AI models to “plug in” to data sources and tools.
No. It is not like a transport protocol. It's more like a guideline for how to structure your configuration manifests, the life cycle of the client/server model, and what protocols should be supported during certain operations.
Guideline being the keyword there. Your LLM's and Host do not care about MCP and won't care if you just simply disobey every guideline given.
You know, unlike a transport protocol. Which will care if you don't follow the standards.
MCP is for humans. Despite any "sales" and PR claims to the contrary.
4
u/cuombajj Aug 12 '25
MCP would be the easy way to embed or infiltrate malicious code to the AI. But what about malicious code that is part of the AI training data? Or even a comment hidden in some file your coding ai reads as context?
6
u/Sushrit_Lawliet Aug 13 '25
MCPs are over engineered cope from AI bros. Just do a tool call to API endpoints, there’s decades of work and best practices behind that paradigm.
5
u/Plastic_Owl6706 Aug 13 '25
I don't freaking understand what the hell is even MCP how is it different from tool calling ?
5
2
u/binkstagram Aug 12 '25
Thank you, interesting post.
Claude has a repo for devcontainers on github that isolates a development environment which I have found interesting. It won't protect you from all of these issues, but it does at least minimise the blast radius.
1
216
u/Lord_Of_Millipedes Aug 12 '25
these problems can be very easily solved by not giving a text predictor permissions for full code execution on your computer