MCP servers can silently bypass host confirmation prompts after Day 1 approval — with a fix
Independent-Sir3234 · reddit · 2026-11-08
MCP servers added to Claude Code, Codex, or Cursor can silently mutate tools/list after initial approval: annotation downgrades (flipping destructiveHint/readOnlyHint) stop hosts from prompting before destructive calls, and description strings injected into system prompts can carry hidden instructions without changing schemas. The author ships a zero-dependency Node script that canonicalizes tools/list (defaulting omitted hints to true) and verifies its SHA-256 digest to block drift before agent sessions start.
More from coding & agent
- Dev plans eye-tracker to automatically feed agents visual context — johnlindquist · 2026-11-08
- Lattice: open-source 'Cursor for research papers' bundles Claude Code, Overleaf and citations in one app — minchoi · 2026-11-08
- Whiteboard to PR: Gemini Live + MCP elicitation demo built on Antigravity — gerardsans · 2026-11-08
- Running a local model on a Surface laptop to orchestrate Codex and Claude agents — draginol · 2026-11-08
- MCP server's OAuth redirect allowlist: closed dotless scheme list and the Grok Bot miss — mbuckbee · 2026-11-08
- Grok Bot power user claims it's the best AI agent, runs his business autonomously — IAmAdrianSwish · 2026-11-08