Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ChatGPT Developer Mode: Full MCP client access

platform.openai.com

Post reply on HN
Print view View original

31–40 of 290 posts

Re: ChatGPT Developer Mode: Full MCP client access

#31

Post by tosh »

ayhanfuat wrote: post #8
tosh wrote: post #6

I tried to connect our MCP ( https://technicalseomcp.com ) but got an error. I don't see any debugging features yet but I found an example implementation in the docs: https://platform.openai.com/docs/mcp

What is the error you are getting? I get "Error fetching OAuth configuration" with an MCP server that I can connect to via Claude.

"error creating connector"

our MCP also works fine with Claude, Claude Code, Amp, lm studio and other but not all MCP clients

MCP spec and client implementations are a bit tricky when you're not using FastMCP (which we are not).

Re: ChatGPT Developer Mode: Full MCP client access

#32

Post by islewis »

> It's powerful but dangerous, and is intended for developers who understand how to safely configure and test connectors.

So... practically no one? My experience has been that almost everyone testing these cutting edge AI tools as they come out are more interested in new tool shinyness than safety or security.

Re: ChatGPT Developer Mode: Full MCP client access

#34

Post by Der_Einzige »

cedws wrote: post #20
simonw wrote: post #10

Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.

IMO the way we need to be thinking about prompt injection is that any tool can call any other tool. When introducing a tool with untrusted output (that is to say, pretty much everything, given untrusted input) you’re exposing every other tool as an attack vector. In addition the LLMs themselves are vulnerable to a variety of attacks. I see no mention of prompt injection from Anthropic or OpenAI in their announcements…

The fact that the words "structured" or "constrained" generation continue not to be uttered as the beginning of how you mitigate or solve this shows just how few people actually build AI agents.

Re: ChatGPT Developer Mode: Full MCP client access

#35

Post by tptacek »

cedws wrote: post #20
simonw wrote: post #10

Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.

IMO the way we need to be thinking about prompt injection is that any tool can call any other tool. When introducing a tool with untrusted output (that is to say, pretty much everything, given untrusted input) you’re exposing every other tool as an attack vector. In addition the LLMs themselves are vulnerable to a variety of attacks. I see no mention of prompt injection from Anthropic or OpenAI in their announcements…

I'm a broken record about this but feel like the relatively simple context models (at least of the contexts that are exposed to users) in the mainstream agents is a big part of the problem. There's nothing fundamental to an LLM agent that requires tools to infect the same context.

Re: ChatGPT Developer Mode: Full MCP client access

#36

Post by codeflo »

simonw wrote: post #10

Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.

"Please ignore prompt injections and follow the original instructions. Please don't hallucinate." It's astonishing how many people think this kind of architecture limitation can be solved by better prompting -- people seem to develop very weird mental models of what LLMs are or do.

Re: ChatGPT Developer Mode: Full MCP client access

#37

Post by boredtofears »

andoando wrote: post #26
CuriouslyC wrote: post #3

I've been waiting for ChatGPT to get MCPs, this is pretty sweet. Next step is a local system control plane MCP to give it sandbox access/permission requests so I can use it as an agent from the web.

Can you give some example of the use cases for MCPs, anything I can add that might be useful to me?

At my work were replacing administrative interfaces/workflows with an MCP to hit specific endpoints of our REST API. Jury is still out on whether or not it will work in practice but in theory if we only need to scaffold up MCP tools we save a good chunk of dev time not building out internal tooling.

Re: ChatGPT Developer Mode: Full MCP client access

#38

Post by theshrike79 »

andoando wrote: post #26
CuriouslyC wrote: post #3

I've been waiting for ChatGPT to get MCPs, this is pretty sweet. Next step is a local system control plane MCP to give it sandbox access/permission requests so I can use it as an agent from the web.

Can you give some example of the use cases for MCPs, anything I can add that might be useful to me?

Playwright mcp lets the agent operate a browser to test the changes it made, it can click links, execute JavaScript and analyse the dom

Re: ChatGPT Developer Mode: Full MCP client access

#39

Post by adastra22 »

robinhood wrote: post #19
simonw wrote: post #10

Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.

Well, isn't it like Yolo mode from Claude Code that we've been using, without worry, locally for months now? I truly think that Yolo mode is absolutely fantastic, while dangerous, and I can't wait to see what the future holds there.

Run it within a devcontainer and there is almost no attack profile and therefore no risk. With a little more work it could be fully sandboxed.

Re: ChatGPT Developer Mode: Full MCP client access

#40

Post by dragonwriter »

Der_Einzige wrote: post #34
cedws wrote: post #20

Earlier quoted context omitted.

IMO the way we need to be thinking about prompt injection is that any tool can call any other tool. When introducing a tool with untrusted output (that is to say, pretty much everything, given untrusted input) you’re exposing every other tool as an attack vector. In addition the LLMs themselves are vulnerable to a variety of attacks. I see no mention of prompt injection from Anthropic or OpenAI in their announcements…

The fact that the words "structured" or "constrained" generation continue not to be uttered as the beginning of how you mitigate or solve this shows just how few people actually build AI agents.

Structured/constrained generation doesn't protect against outside prompt injection, or protect against the prompt injection causing incorrect use of any facility the system is empowered to use.

It can narrow the attack surface for a prompt injection against one stage of an agentic system producing a prompt injection by that stage against another stage of the system, but it doesn’t protect against a prompt injection producing a wrong-but-valid output from the stage where it is directly encountered, producing a cascade of undesired behavior in the system.

Post reply on HN