Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “S” in MCP Stands for Security

elenacross7.medium.com

Post reply on HN
Print view View original

181–189 of 189 posts

Re: The “S” in MCP Stands for Security

#181

Post by __MatrixMan__ »

wat10000 wrote: post #179
__MatrixMan__ wrote: post #176

Earlier quoted context omitted.

I'm not sure I'd characterize those two things as "it doesn't take much," that's quite a lot to give to an untrusted entity.

My whole point is that you must consider this entity to be untrusted, which is pretty strongly at odds with having it act as an agent. It can’t both have access to private data and the outside world.

I guess it's just that I've given up on expecting them to be able to police themselves. Even if there was some fundamental change which made it plausible, it would likely be implemented by somebody I don't know or trust--so I'm going to be locking it down via OS-level controls anyway. And since I'm going to do that, doesn't the self-policing part then become redundant?

If it's not allowed to do something, I'd rather it just show me the error it got when it tried and leave it to me to tweak the containment or not. Having it refuse because it's not allowed according to its own internal logic just creates a whole separate set of less-common error messages that I'll have to search for, each of which is opaquely equivalent to one that we have decades of experience with. There is a battle-hardened interface for this sort of thing and reimplementing it internally to the LLM just isn't worth the squeeze.

I will confess that I've previously run untrusted agents (e.g. from CircleCI) as my own user without giving them due scrutiny. And shame on me for doing so. I just don't think that my negligence would be any greater had it contained an LLM.

Re: The “S” in MCP Stands for Security

#183

Post by lsaferite »

sanderjd wrote: post #180
lsaferite wrote: post #168

Earlier quoted context omitted.

Benefit: A standard and purpose driven protocol for connecting agents (MCP Host/MCP Clients) to tools, resources, and prompts (MCP Server) that also exposes LLM services to said MCP Servers. The alternative you suggest is manually integrating each set of tools or data? Or maybe there's some misunderstanding about MCP? MCP currently has 2 transports, stdio and HTTP+SEE . The second one is, in fact, a "network-accessib…

No, the alternative I suggest is "can't agents figure out how to use existing kinds of APIs if they are documented well?". I think the answer is that in the current state of the art, it's very useful to give them a nudge to help them along. But I feel like eventually I should be able to publish an API spec or a well documented interface / protocol / whatever my programming language calls it, and an agent should be ab…

Sure, "eventually" you'll be able to point an agent at an arbitrary API and have it figure things out. We have a ways to go before we get there, but we will get there.

Re: The “S” in MCP Stands for Security

#184

Post by daxfohl »

Spivak wrote: post #155
teaearlgraycold wrote: post #122

Earlier quoted context omitted.

MCP is poorly named. That is why it’s confusing to many people. It’s a tool use protocol. It provides means to list tools provided by a server as well as manage asynchronous tasks. It’s transport agnostic and uses JSON-RPC to format requests and responses. It’s different in that it’s designed to provide natural language instructions to LLMs and is a pretty open-ended protocol. It’s not like the Language Server Protoc…

I think it makes more sense to think of them as agent software plugins than a protocol that makes sense in isolation. The reason for its existence is because you want your to work with someone's AI agent. You write some code, your user integrates it with their local software and you provide data to it in the format that it's expecting and do stuff when asked.

https://github.com/block/goose tutorials page finally made it click for me. Concrete examples. Anthropic should link directly out to that from their docs.

Re: The “S” in MCP Stands for Security

#185

Post by sanderjd »

lsaferite wrote: post #183
sanderjd wrote: post #180

Earlier quoted context omitted.

No, the alternative I suggest is "can't agents figure out how to use existing kinds of APIs if they are documented well?". I think the answer is that in the current state of the art, it's very useful to give them a nudge to help them along. But I feel like eventually I should be able to publish an API spec or a well documented interface / protocol / whatever my programming language calls it, and an agent should be ab…

Sure, "eventually" you'll be able to point an agent at an arbitrary API and have it figure things out. We have a ways to go before we get there, but we will get there.

Fair enough!

Re: The “S” in MCP Stands for Security

#188

Post by cnych »

MCP, as a bridge connecting AI models with development environments, certainly faces complex security challenges. The permission model mentioned in the article needs detailed design, requiring thorough consideration of protocol layer security, transport layer encryption, and permission boundary control. For developers looking to implement MCP, understanding existing server implementations can be very helpful. This MCP servers directory https://www.claudemcp.com/servers collects various implementation options, allowing you to compare different security models and choose an implementation that fits your specific needs. The security audit points discussed in the article are on target, but I believe we should also add dynamic filtering of model outputs and pre-execution validation. Developers need to find the balance between convenience and security, as excessive restrictions affect development experience, while loose policies may introduce security vulnerabilities.

How should we define the security interaction boundary between LLMs and development environments? This question has different best practices in various application scenarios, and is worth our continued exploration.

Re: The “S” in MCP Stands for Security

#189

Post by greenie_beans »

consumer451 wrote: post #182
greenie_beans wrote: post #54

this is why i'm getting into security instead of ai

This should not be an either or situation. To me, the correct answer is: both.

no. i can either become a ML expert or a security expert. not both. i speak for myself, though.

i'll let the ML experts make the tools that i use, but also have good job prospects because infosec fundamentals will always be needed. especially if we have product managers like the sibling commenter who is certain that he will have an AI product that changes the infosec world, even though the person has zero background in security. to me, that is even more encouraging about the job security.

also, the herd is going to AI. maybe i'm a contrarian, unfortunately, but that seems like a good signal to not follow the herd, but instead get into something that the herd will need more of.

Post reply on HN