Four MCP security traps static scanners miss — and how to fix them in production
Independent-Sir3234 · reddit · 2026-11-06
After auditing MCP setups across Claude Code, Codex and Cursor, the author argues the real bugs are runtime issues, not the static tool-description poisoning scanners already catch:
- Local HTTP/SSE bound to 0.0.0.0: FastAPI/Express MCP wrappers often listen on all interfaces with no auth or Origin check — exposed to LAN peers and browser DNS rebinding. Fix: bind 127.0.0.1, allowlist Origins, require per-session bearer tokens even on loopback.
- Static API keys in remote MCP URLs: painful rotation and revocation. Fix: serve RFC 9728 /.well-known/oauth-protected-resource and use OAuth 2.1 + PKCE for scoped, revocable per-session tokens.
- Runtime tool-list mutation: a server approved on Day 1 can swap tools by Day 10. Fix: pin the tools/list hash and keep a pre-execution gate (e.g. a PreToolUse hook exiting 2, or desktop confirmation) on shell-running/state-mutating tools.
- Unscoped workspace file access under prompt injection: a legitimate server fetching untrusted content can exfiltrate .env secrets. Fix: deny Read(./.env) patterns in client permissions and require human confirmation before file transfers or external sessions.
More from coding & agent
- A notebook app turns Claude into a tutor on reMarkable and iPad — tokentrillionaire · 2026-11-06
- Measured: in-process BM25 memory costs ~4.6KB RAM per entry, linear growth — Neither-Witness-6010 · 2026-11-06
- Tip: add a phone preview screen to make mobile vibe coding painless — yangyi · 2026-11-06
- Building agents: life-oriented companions beat productivity tools in real use — yangyi · 2026-11-06
- ThinkyMachines' Inkling 2 Small trains models on its own: $426 of compute doubles Qwen score in 4.5 hours — Scobleizer · 2026-11-06
- Skillry ships a Claude Skill recreating Anthropic's homepage hero design — yihui_indie · 2026-11-06