Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

From MCP to shell: MCP auth flaws enable RCE in Claude Code, Gemini CLI and more

verialabs.com

Post reply on HN
Print view View original

1–10 of 45 posts

Re: From MCP to shell: MCP auth flaws enable RCE in Claude Code, Gemini CLI and more

#2

Post by fennecbutt »

Unsurprising. I've left many a comment on what I think of MCP and so have many others.

I'm still not sure why everyone's acting like it's some well thought out system and not just tool descriptions shoveled into JSON and then shoved at an LLM. It's not a fundamental architectural change to enhance tool calls, it just got given a fancy name.

I do get that having a common structure for tool calling is very convenient but it's not revolutionary. What's revolutionary is everyone training their models for a tool calling spec and I'm just not sure that we've seen that yet.

Re: From MCP to shell: MCP auth flaws enable RCE in Claude Code, Gemini CLI and more

#3

Post by greysteil »

fennecbutt wrote: post #2

Unsurprising. I've left many a comment on what I think of MCP and so have many others. I'm still not sure why everyone's acting like it's some well thought out system and not just tool descriptions shoveled into JSON and then shoved at an LLM. It's not a fundamental architectural change to enhance tool calls, it just got given a fancy name. I do get that having a common structure for tool calling is very convenient b…

I dunno, I’m still pretty surprised the MCP server auth process could pop a calculator on widely adopted clients. The protocol isn’t perfect but that’s totally unnecessary unsafe. Glad it’s fixed!

Re: From MCP to shell: MCP auth flaws enable RCE in Claude Code, Gemini CLI and more

#6

Post by orphea »

greysteil wrote: post #3
fennecbutt wrote: post #2

Unsurprising. I've left many a comment on what I think of MCP and so have many others. I'm still not sure why everyone's acting like it's some well thought out system and not just tool descriptions shoveled into JSON and then shoved at an LLM. It's not a fundamental architectural change to enhance tool calls, it just got given a fancy name. I do get that having a common structure for tool calling is very convenient b…

I dunno, I’m still pretty surprised the MCP server auth process could pop a calculator on widely adopted clients. The protocol isn’t perfect but that’s totally unnecessary unsafe. Glad it’s fixed!

  > Glad it’s fixed!
...and they used some random package with version 0.0.1 instead of writing 20 lines of code themselves.

It's astonishing how allergic some people are to writing their own code, even the simplest shit has to be a dependency. Let's increase the attack surface, that's fine, what can go wrong, right?

https://github.com/modelcontextprotocol/use-mcp/commit/96063...

Re: From MCP to shell: MCP auth flaws enable RCE in Claude Code, Gemini CLI and more

#7

Post by mehdibl »

IT start with "Evil MCP Server".

So you need a server flawed + XSS issue on Cloudflare.

Then you need to use Claude Code, so it's more an issue in Claude Code/Gemini implementation already than MCP.

So if you are ok to run any MCP from any source you have worse issues.

But good find in the open command how it's used in Claude Code/Gemini.

Re: From MCP to shell: MCP auth flaws enable RCE in Claude Code, Gemini CLI and more

#9

Post by CuriouslyC »

fennecbutt wrote: post #2

Unsurprising. I've left many a comment on what I think of MCP and so have many others. I'm still not sure why everyone's acting like it's some well thought out system and not just tool descriptions shoveled into JSON and then shoved at an LLM. It's not a fundamental architectural change to enhance tool calls, it just got given a fancy name. I do get that having a common structure for tool calling is very convenient b…

MCP is legit bad, and it won't last long, just polluting context with MCP output alone is enough to make it a poor long term solution. We're going to end up with some sort of agent VM, where tool data can be conditionally expanded for processing in a given turn without persistently polluting context (think context templates).

Re: From MCP to shell: MCP auth flaws enable RCE in Claude Code, Gemini CLI and more

#10

Post by mehdibl »

behnamoh wrote: post #5

I've disabled all MCP servers on my machine until this security nightmare is fully resolved. MCP is not that elegant anyway, looks more like a hack and ignores decades of web dev/security best practices.

What the issues, if you use quality MCP tools?

Also MCP is only transport and there is a lot of mixup to blame the MCP, as most of the prompt injection and similar come from the "TOOLS" behind the MCP. Not MCP as it self here.

Seem this security hype forget one key point: Supply chain & trusted sources.

What is the risk running an MCP server from Microsoft? Or Anthropic? Google?

All the reports explain attacks using flawed MCP servers, so from sources that either are malicious or compromised.

Post reply on HN