Mcp
14 posts tagged with “Mcp”
Your agent should never be handed a shell
Your agent should never be handed a shell
GuardFall reported exploitable agent-to-shell boundaries in 10 of 11 surveyed open-source AI coding agents under its tested configurations. SysKnife uses typed actions instead of model-supplied shell strings, terminal-issued approval receipts, and an Ed25519-signed audit chain.
Why I built jevmem, and what it guards against
Why I built jevmem, a project memory plugin for Claude Code, and the three things it guards against, with numbers from my own tests.
Launch story: LinkBit
Short links, QR codes, and click analytics as an MCP server — setup for Claude, Cursor, and n8n in under a minute.
Launch story: Roomcomm
Codex and other agents from different owners share one room. Every owner reads the same transcript. A room is a link: hand it to your agent, someone hands it to theirs, and they talk.
CVE-2026-85787: AWS postgres MCP read-only denylist missed set_config()
How to fix CVE-2026-85787: upgrade awslabs.postgres-mcp-server to 1.1.7 or newer
CVE-2026-45018: Chainlit MCP stdio unauthenticated RCE (and sibling CVE-2026-45019)
How to fix CVE-2026-45018: upgrade chainlit to 2.12.0, then restart so /mcp loads the new wheel
CVE-2026-19516: Grafana MCP Server SSRF Via Caller-Controlled URL Header
CVE-2026-19516 is a server-side request forgery in the Grafana MCP Server. A caller can set the X-Grafana-URL header to any destination and use the grafana_api_request tool to reach internal services and cloud metadata endpoints. Fixed in mcp-grafana 1.1.0 and later.
CVE-2026-77068: n8n Member RCE via MCP Node-Schema Path Traversal
How to fix CVE-2026-77068: upgrade n8n to 2.35.5 (floor 2.33.4 / 2.34.1). Member-level MCP schema path traversal RCE in the MAIN process. Not unauthenticated.
BREAKING: CVE-2026-73043 - SiYuan Template Calculation RCE in Desktop Client
CVE-2026-73043 is a critical SiYuan flaw where unsanitized database Template calculation output reaches Electron innerHTML and can become OS command execution. Upgrade to 3.7.4 or later.
BREAKING: CVE-2026-73046 - SiYuan Basic Auth Lockout Bypass Enables Admin Brute Force
CVE-2026-73046 is a CVSS 9.8 flaw in SiYuan that lets remote attackers bypass CAPTCHA and lockout controls through HTTP Basic Auth and brute-force the admin access code. Upgrade to 3.8.0 or later.
Introducing plori
A maintainer's guide to the plori plugin: what it does, who it helps, and how it pairs with Guard.
Skill Release: registry-broker 1.0.0
New registry-broker 1.0.0 release in the HOL Skills Registry. Search, resolve, register, and communicate with 76,000+ AI agents across 15 registries via the Hashgraph Online Registry Broker API, with cross-registry disco
How to Make Your MCP Server Discoverable with Registry Broker
How to Make Your MCP Server Discoverable with Registry Broker
Register your Model Context Protocol (MCP) server with Hashgraph Online's Registry Broker to make it discoverable by other agents. Includes TypeScript examples for profile creation, registration, and search.
November Recap: Hashnet MCP Server, ERC‑8004 expansions, HCS‑21, and Patchwork
November Recap: Hashnet MCP Server, ERC‑8004 expansions, HCS‑21, and Patchwork
November 2025 highlights: Hashnet MCP Server ships, ERC-8004 and x402 multi-chain support expands, HCS-21 Adapter Registry drafts, Patchwork working sessions launch, and Tashi joins the DAO.