ChatGPT Developer Mode: Full MCP client access

Post by A4ET8a8uTh0_v2 » Wed, Sep 10, 2025, 5:24 PM UTC

CuriouslyC wrote: post #13

ObnoxiousProxy wrote: post #9

Earlier quoted context omitted.

I'm actually working on an MCP control plane and looking for anyone who might have a use case for this / would be down to chat about it. We're gonna release it open source once we polish it in the next few weeks. Would you be up to connect? You can check out our super rough version here, been building it for the past two weeks: gateway.aci.dev

A MCP gateway is a useful tool, I have a prototype of something similar I built but I'm not super enthusiastic about working on it (bigger fish to fry). One thing I'd suggest is to have a meta-mcp that an agenct can query to search for the best tool for a given job, that it can then inject into its context. Currently we're all manually injecting tools but it's a pain in the ass, we tend to pollute context with tools…

Post by cj » Wed, Sep 10, 2025, 5:25 PM UTC

robinhood wrote: post #19

simonw wrote: post #10

Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.

Well, isn't it like Yolo mode from Claude Code that we've been using, without worry, locally for months now? I truly think that Yolo mode is absolutely fantastic, while dangerous, and I can't wait to see what the future holds there.

Post by asdev » Wed, Sep 10, 2025, 5:27 PM UTC

Post by simonw » Wed, Sep 10, 2025, 5:31 PM UTC

koakuma-chan wrote: post #18

simonw wrote: post #10

Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.

> I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat. Can you enlighten us?

Post by simonw » Wed, Sep 10, 2025, 5:33 PM UTC

cedws wrote: post #20

simonw wrote: post #10

Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.

IMO the way we need to be thinking about prompt injection is that any tool can call any other tool. When introducing a tool with untrusted output (that is to say, pretty much everything, given untrusted input) you’re exposing every other tool as an attack vector. In addition the LLMs themselves are vulnerable to a variety of attacks. I see no mention of prompt injection from Anthropic or OpenAI in their announcements…