Auditing my MCP credential broker: the worst hole was the config file
Relevant_Mousse_9117 · reddit · 2026-11-02
A maintainer of a small MCP credential broker (API/SSH/DB secrets in the OS keychain, agent access via allow-listed calls) re-audited everything assuming the agent is fully prompt-injected and can write any file. Three unexpected findings:
- The agent could edit the config. Each session starts a fresh server that trusts config.toml; the agent could flip a preset to auto-approve, and a --confirm-auto flag didn't help since the agent has a shell. Fix: auto-approve only holds in the exact form a human confirmed with a click.
- The prompt didn't show the host. GET /user/repos looked identical after baseurl was changed.
- POST allowed DELETE. Laravel honors ?method=DELETE, and the query string was never checked.
Lesson: nothing the agent can write should decide what the agent is allowed to do.
More from coding & agent
- Before automating a workflow with AI, ask if anyone understands it end to end — djgoel123 · 2026-11-02
- One stale date silently broke a WhatsApp reply agent: 19 messages unanswered — petrusenko_max · 2026-11-02
- The 10X engineer is now just a SKILLS.md: 6 workflow rules for AI coding agents — mdancho84 · 2026-11-02
- AWS's open-source Strands Harness claims 45% cheaper than Claude Code, reigniting harness debate — blaizedsouza · 2026-11-02
- Xiaomi MiMo's CodeSpecWeave trains coding agents on interdependent specs for long-horizon coding — XiaomiMiMo · 2026-11-02
- Sketchy v0.1.6: AI diagrams use 29% fewer output tokens than plain text — Nkgsporty · 2026-11-02