The State of MCP Security [pdf]

1 comments

• shitloadofbooks37 minutes ago
  I couldn&#x27;t find anything else to do exactly what I wanted (or wasn&#x27;t just a blatent rugpull towards &quot;enterprise pricing&quot; waiting to happen) so I slopped together an MCP Proxy that uses FastMCP to proxy a list of upstream MCPs behind Entra oauth, with CEL-expressions for per-tool RBAC.<p>The peace of mind it brought not trusting other people&#x27;s slopped out MCPs to do the right thing with authentication is immense.<p>It&#x27;s internal only, but it was a Fable 5 one-shot (3 shot if you count a second prompt to generate the Helm Chart and docs site) that you could DIY because the FastMCP library is extremely sensible and well-documented.
  • mavzer17 minutes ago
    Nice. Basically, I see 3 ways the MCP ecosystem converging<p>- Centralized, well trusted sources for MCP servers - Technical people like you creating their own, private MCPs for specific use cases - An MCP governance layer that brings a bit of sense into this new world<p>Otherwise, it’s a security time bomb. We already see MCP specific attacks out in the wild.