MCP server review: gate tool writes on auth/traversal findings, not test score
SamuelFmedeiros · reddit · 2026-10-17
The author shares a fail-closed MCP server review checklist after finding a path traversal bug and a non-constant-time token comparison in tools whose tests all passed. Any auth bypass, traversal, injection or secret-in-diff finding blocks release regardless of score; the checklist covers header tokens, constant-time compare, path normalization before resolve(), isrelativeto, per-tool scopes, output escaping, timeouts and 429 rate limiting. The generic review loop is open-sourced.
More from coding & agent
- Pydantic Monty ships TypeScript bindings to sandbox model-written Python in Node and browsers — samuelcolvin · 2026-10-17
- LangChain's deepagents adds Gemini support with 1M tokens and agentic video understanding — hwchase17 · 2026-10-17
- Dev swaps codex remote and Claude remote control for T3 Code mobile — rudrank · 2026-10-17
- Perplexity Flash matches Wald's accuracy at nearly 2x speed in local agent-decision benchmark — WolframRvnwlf · 2026-10-17
- Celesto CI runs cache-hit jobs 23% faster than GitHub Actions on half the CPUs — aniketmaurya · 2026-10-17
- Jev vs tabular foundation models: zero-shot decision routing is not grounded prediction — Arindam_1729 · 2026-10-17