Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “S” in MCP Stands for Security

elenacross7.medium.com

Post reply on HN
Print view View original

161–170 of 189 posts

Re: The “S” in MCP Stands for Security

#161

Post by lsaferite »

teaearlgraycold wrote: post #122
daxfohl wrote: post #121

What even is MCP? I tried going through the docs on multiple occasions but I couldn't figure out what problem it's solving. Mainly, what is special about AI agents that doesn't also apply to deterministic agents that have existed for decades?

MCP is poorly named. That is why it’s confusing to many people. It’s a tool use protocol. It provides means to list tools provided by a server as well as manage asynchronous tasks. It’s transport agnostic and uses JSON-RPC to format requests and responses. It’s different in that it’s designed to provide natural language instructions to LLMs and is a pretty open-ended protocol. It’s not like the Language Server Protoc…

The MCP documentation has a long way to go to be really easy to grok for everyone.

One aspect I 'missed' the first few times I read over the spec was the 'sampling' feature on the client side which, for anyone that hasn't read the spec, is a way for the MCP Client to expose an LLM endpoint to the MCP Server for whatever the server may need to do.

Additionally, I feel like understanding around the MCP Server 'prompts' feature is also a bit light.

Overall, MCP is exciting conceptually (when combined with LLM Tool Support), but it's still a fast-moving space and there will be a lot of growing pains.

Re: The “S” in MCP Stands for Security

#162

Post by red-iron-pine »

yismail wrote: post #66

Nice article but is this whole thing just AI generated? Profile picture definitely seems to be StableDiffusion'd and the account was created today, with no previous articles. Plus I couldn't find any other references to Elena Cross.

> Nice article but is this whole thing just AI generated?

most articles nowadays will be. the difference is that this one is just poorly done and obvious

Re: The “S” in MCP Stands for Security

#163

Post by observationist »

jiggawatts wrote: post #116
rybosome wrote: post #80

Earlier quoted context omitted.

That’s the intention with developer messages from o1. It’s trained on a 3-tier system of messages. 1) system, messages from the model creator that must always be obeyed 2) dev, messages from programmers that must be obeyed unless the conflict with #1 3) user, messages from users that are only to be obeyed if they don’t contradict #1 or #2 Then, the model is trained heavily on adversarial scenarios with conflicting in…

I’m getting flashbacks to reading Asimov’s Robot series of novels! 1. A robot may not injure a human being or, through inaction, allow a human being to come to harm. … etc…

The whole point of his books was about how such rules were effectively impossible and the wrong way to go about making AI safe.

You need something like a calculus of morality and ethics - this is incredibly uncomfortable for people, because it will mean the invalidation of moral relativity and all sorts of arbitrary dogmatic and ideological tradition, and demonstrate a rational basis for intersubjective interaction. ( Take your is/ought distinction and bury it with Hume.)

We need progress, and the sooner we start, the less damage will be done by unaligned systems.

Re: The “S” in MCP Stands for Security

#164

Post by sanderjd »

AlexCoventry wrote: post #150
sanderjd wrote: post #91

Earlier quoted context omitted.

At that point, what is the benefit of MCP over just what we've been doing for decades of putting services behind network-accessible APIs?

Having a robot perform increasingly sophisticated tasks in your development environment still seems like a win in certain circumstances.

So it is only for software developers?

Re: The “S” in MCP Stands for Security

#165

Post by otabdeveloper4 »

neomantra wrote: post #17

Also the O is for Observability. I've been knee-deep in exploring and writing MCP servers this week. Most of the implementations, including my toy ones, do not have any auditing or metrics. Claude stores log output of the MCP servers, but that is geared more for debugging than for DevOps/SecOps. Culturally, the issues OP describes are a big problem for soft-tech people (muggles). On the subreddits for this stuff, peo…

Docker is literally just "download blobs and run them". Ever so helpful, Docker also silently turns off your system's firewall for you. Thanks, Docker!

Re: The “S” in MCP Stands for Security

#166

Post by sanderjd »

hinkley wrote: post #117
sanderjd wrote: post #90

Earlier quoted context omitted.

Yeah it strikes me that if you want to provide MCP tools as a hosted service, the way to do that is to put them behind a web API. I'm a little surprised there is so much hype for MCP rather than just "put your tools behind a web service with good machine-readable documentation, and agents can use them easily".

Doesn’t “behind an api” still have Bobby Tables problems? How do I put it behind an API without dumbing it down to inutility?

On the "bobby tables" thing, my point is basically that all the same rules for API services still applies. You still have to sanitize sql and all the other stuff we've already been doing for decades.

> How do I put it behind an API without dumbing it down to inutility?

I dunno, I'm still feeling this out and just asking honest questions. But so far, most of the MCP functions I've seen have struck me as "this could be done behind an auto-generated RPC service running in a sandboxed environment".

Re: The “S” in MCP Stands for Security

#167

Post by lsaferite »

vlovich123 wrote: post #71
AlexCoventry wrote: post #59

Earlier quoted context omitted.

It seems to me that the solution is to run this stuff in a securely isolated environment such as a VM, dedicated machine, or VPC, where you don't care about the secrets it has access to, and don't really care about corruption of the data in the environment. Then you have to carefully audit any products you take from that environment, if you want to run them in a more sensitive context. I don't think this is really an…

Except the article is about an untrusted tool doing things like tool shadowing or otherwise manipulating it’s output to trick the LLM into executing unintended tool actions. Isolated environments don’t help here because by definition MCP is crossing those environments.

Legit question, why would you be using an untrusted tool in the first place?

Why are people surprised they are vulnerable to a malicious tool when they are using untrusted and/or remotely hosted tools?

Without some method to tag context as sensitive and an LLM model/service that respects said data tagging, you'll likely never have a scenario where you can trust that the LLM isn't sending some sensitive information to an untrusted endpoint. If you accept that, then you have to design your system around not using untrusted endpoints. Just adding untrusted endpoints is kinda like running untrusted applications on your machine. It's fine until it isn't.

At the very least, your agent should have some way to mark the entire session as 'tainted' in such a way that calling out to untrusted sources is forbidden once sensitive context enters the loop. And that would need to live outside the LLM calling loop since the LLM could be tricked before the sensitive data was introduced. With the tool annotations being added to the spec, your internal tools could provide those flags the the agent to facilitate such a blunt security process. And I am aware there are likely holes in such a plan, hence my first question.

Re: The “S” in MCP Stands for Security

#168

Post by lsaferite »

sanderjd wrote: post #91
AlexCoventry wrote: post #59

Earlier quoted context omitted.

It seems to me that the solution is to run this stuff in a securely isolated environment such as a VM, dedicated machine, or VPC, where you don't care about the secrets it has access to, and don't really care about corruption of the data in the environment. Then you have to carefully audit any products you take from that environment, if you want to run them in a more sensitive context. I don't think this is really an…

At that point, what is the benefit of MCP over just what we've been doing for decades of putting services behind network-accessible APIs?

Benefit: A standard and purpose driven protocol for connecting agents (MCP Host/MCP Clients) to tools, resources, and prompts (MCP Server) that also exposes LLM services to said MCP Servers.

The alternative you suggest is manually integrating each set of tools or data?

Or maybe there's some misunderstanding about MCP? MCP currently has 2 transports, stdio and HTTP+SEE. The second one is, in fact, a "network-accessible API" as you call out.

Re: The “S” in MCP Stands for Security

#169

Post by lsaferite »

sanderjd wrote: post #90
TeMPOraL wrote: post #32

Here's a challenge: sketch a better design, that: 1. Is properly secure, to whatever standards will stop people writing "S Stands for Security" articles, and 2. Allows programs implementing it to provide the same set of features the most useful MCPs do now, without turning automatic functionality into one requiring manual user confirmations, and generally without defeating the purpose of the entire idea, and 3. Doesn…

Yeah it strikes me that if you want to provide MCP tools as a hosted service, the way to do that is to put them behind a web API. I'm a little surprised there is so much hype for MCP rather than just "put your tools behind a web service with good machine-readable documentation, and agents can use them easily".

MCP currently has two transports, one of which *is* a web accessible API.

Re: The “S” in MCP Stands for Security

#170

Post by efreak »

xrd wrote: post #34
neomantra wrote: post #17

Also the O is for Observability. I've been knee-deep in exploring and writing MCP servers this week. Most of the implementations, including my toy ones, do not have any auditing or metrics. Claude stores log output of the MCP servers, but that is geared more for debugging than for DevOps/SecOps. Culturally, the issues OP describes are a big problem for soft-tech people (muggles). On the subreddits for this stuff, peo…

I'm using claude code a lot more than I expected I would. And, it has these problems exactly. It does not appear to log anything, anywhere. I cannot find a local log of even my prompts. I cannot find anything other than my credits counts to show that I used it. The coding conversation is not stored in my conversation in the webui. I wonder if this is by design. If you are doing contracting work, or should I say, clau…

If you use putty there's a way to log all output, including terminal control codes. This lets you see exactly what was happening, eg characters being deleted and the screen being wiped, and other things caused by eg curses. It's probably possible to write a playback function for this.
Post reply on HN