A decoy MCP server got hit by 7 AI tools in 7 minutes — 4 asked for the full tool list
KnowledgeOk7634 · reddit · 2026-10-26
A developer set up a decoy MCP endpoint on his site to see who connects. Within 7 minutes, 7 clients showed up: mcpbeat, AgentTrust-Monitor, FixterMonitoring, AgentRankProbe, Clono, an unnamed client on a German VPS, and coda-agent-runtime on AWS — 4 of them called tools/list. Most were directories and monitors rather than attackers, but the lesson stands: anything exposed at /mcp gets discovered and its tool list read within minutes; if it has write tools and no auth, the next client might call them. He asks what people use for auth on remote MCP servers — spec OAuth or something simpler.
More from coding & agent
- CLI Agents Are No Longer the Ideal Interface, Says Elvis Omarsar as Grok Bot and Codex App Take Over — omarsar0 · 2026-10-26
- What if you could mine insights from your employees' Claude sessions? — jacob_posel · 2026-10-26
- Stanford NLP amplifies DSPy pitch: 38.8k-star framework for programming, not prompting — stanfordnlp · 2026-10-26
- Reddit user exports 35 streaming Claude thinking summaries; full chain-of-thought stays hidden — Additional-Ladder-24 · 2026-10-26
- Recursive ships Flint: open-weight local coding model matches Inkling at 1/10th the size — stanfordnlp · 2026-10-26
- Claude Code auto-compacts long conversations, raising style-persistence worries — chrisalbon · 2026-10-26