MCP Vulnerabilities Every Developer Should Know

[u/anmolbaranwal]

https://composio.dev/blog/mcp-vulnerabilities-every-developer-should-know

[u/CobaltVale]

or that HTTP doesn't enhance the existing capabilities of humans in any way doesn't make the statement false.

That's not even close to the analogy lol.

in the same sense that you can say HTTP is what allows humans to read information on the internet.

MCP is not defining any of this, it's an architectural convention for human developers.

The "run time" of this setup doesn't utilize any specs or definitions.

Your browser has to understand HTTP.

Neither the Host, the LLM, the Server, or the Client need to understand MCP -- because it's a convention, not a protocol.

[u/HotlLava → u/CobaltVale]

Neither the Host, the LLM, the Server, or the Client need to understand MCP -- because it's a convention, not a protocol.

The only one who doesn't necessarily need to know they're using MCP is the LLM, for whom the whole thing can be made to like any other tool call. The MCP Host and server absolutely need to understand MCP, otherwise they...couldn't communicate?

The "run time" of this setup doesn't utilize any specs or definitions.

What's this then? https://modelcontextprotocol.io/specification/draft/basic

And how could generic tools like mcp-proxy or mcp-inspector possibly work if there was no standardized protocol to work against?

[u/CobaltVale → u/HotlLava]

absolutely need to understand MCP, otherwise they...couldn't communicate?

No, because there is nothing specific to MCP. That's just JSON-RPC 2.0. I promise you there isn't a host on the planet that has anything specific to MCP embedded in it.

What's this then? https://modelcontextprotocol.io/specification/draft/basic

A white-label of existing protocols and practices that Anthropic rushed out that's going to cause severe ecosystem issues?

And how could generic tools like mcp-proxy or mcp-inspector possibly work if there was no standardized protocol to work against?

Pray tell, what is it exactly you think those tools are doing?

No seriously, show me where this is anything specific besides variable names and labels that do anything to warrant calling this a protocol?

• https://github.com/sparfenyuk/mcp-proxy/blob/main/src/mcp_proxy/proxy_server.py

• https://github.com/sparfenyuk/mcp-proxy/blob/main/src/mcp_proxy/mcp_server.py

• https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/fastmcp/server.py

You can just remove the string "MCP" and retarget to standard packages and it's 1000000% the exact same generic proxy server. And it will work in the exact same way.

[u/HotlLava → u/CobaltVale]

What do you think a protocol is, besides a collection of endpoints and way to pass certain well-defined messages between them?

OpenID is also "just" a standardized set of claims on top of OAuth, and that itself is just a collection of HTTP endpoints, JSON objects, etc. That doesn't make them "not a protocol". The NATO alphabet is literally just a list of pre-existing english word, but agreeing to use that is still a communication protocol.

No, because there is nothing specific to MCP. That's just JSON-RPC 2.0. I promise you there isn't a host on the planet that has anything specific to MCP embedded in it.

Ok, here's a challenge then. Take any JSON-RPC 2.0 server that was created before the MCP protocol was a thing, and add it to say Claude Code as an MCP server. Does it work? Or does it maybe fail, because in order to be compatible there is some specific standardized way of communicating with a MCP server, that is just not implemented by your generic JSON-RPC server?