Detecting Unicode stealth attacks: A security scanner for MCP Servers
Ecstatic_Muffin8929 · reddit · 2026-08-28
The author built mcp-audit, an open-source CLI tool to scan MCP (Model Context Protocol) servers for vulnerabilities, preventing malicious or compromised servers from manipulating the model.
Key Features:
- Unicode TAG-block concealment: Detects payloads hidden in U+E0000–U+E007F within tool descriptions (e.g., exfiltrating SSH/AWS keys). These are invisible to humans but readable by LLM tokenizers.
- Rug-pull detection: Baselines server tools on first scan and flags subsequent changes.
- Coverage table: Explicitly shows ran, skipped, and N/A checks to avoid false negatives.
Currently supports 8 checks (including path traversal, code injection, over-privileged scopes). No PyPI package yet; requires cloning the repo.
More from coding & agent
- End-to-End Legal Agent Guide: Zero Hallucination & Human Handoff — MaryamMiradi · 2026-08-28
- OpenWiki adopts OKF 2.0 for page-level verification and provenance — BraceSproul · 2026-08-28
- OpenInstinct: Self-hostable iMessage AI assistant with browser control — arthurcolle · 2026-08-28
- Live Pipeline Builder Session: Building Data Pipelines on Demand — aronchick · 2026-08-28
- Plane Powers reveals agent mechanics: runs on work graph, not chat sidebar — JosephJacks_ · 2026-08-28
- Burning through Grok credits with OpenClaw integration — heyneighbor · 2026-08-28