Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The “S” in MCP Stands for Security

elenacross7.medium.com

Post reply on HN
Print view View original

61–70 of 189 posts

Re: The “S” in MCP Stands for Security

#61

Post by wat10000 »

TeMPOraL wrote: post #58
wat10000 wrote: post #56

Earlier quoted context omitted.

It needs to treat that data as information . If there’s README says to download a tarball and unpack it, that might be phrased as an instruction, but it’s not the same kind of instruction as the “please install this library” from the user. It’s implicitly a “if your goal is X then you can do Y to reach that goal” informational statement. The reader, whether a human or an LLM, needs to evaluate that information to dec…

There is no hard distinction between "code" and "data". Both are the same thing. We've built an entire computing industry on top of that fact, and it sort of works, and that's all with most software folks not even being aware that whether something is code or data is just a matter of opinion.

And yet the distinction must be made. Do you know what it’s called when data is treated as code when it’s not supposed to be? It’s called a “security vulnerability.” Untrusted data must never be executed as code in a privileged context. When there’s a way to make that happen, it’s considered a serious flaw that must be fixed.

Re: The “S” in MCP Stands for Security

#62

Post by ljm »

xrd wrote: post #34
neomantra wrote: post #17

Also the O is for Observability. I've been knee-deep in exploring and writing MCP servers this week. Most of the implementations, including my toy ones, do not have any auditing or metrics. Claude stores log output of the MCP servers, but that is geared more for debugging than for DevOps/SecOps. Culturally, the issues OP describes are a big problem for soft-tech people (muggles). On the subreddits for this stuff, peo…

I'm using claude code a lot more than I expected I would. And, it has these problems exactly. It does not appear to log anything, anywhere. I cannot find a local log of even my prompts. I cannot find anything other than my credits counts to show that I used it. The coding conversation is not stored in my conversation in the webui. I wonder if this is by design. If you are doing contracting work, or should I say, clau…

One of the pet projects I have going is to try and store the interactions as a roam-style knowledge base of connected thought, with the idea that you could browse through this second brain you’ve been talking to afterwards.

Almost every time I’ve asked an LLM to help implement something I’ve given it various clarifying questions so I understand why, and digging through linear UI threads isn’t great.

A decent o11y or instrumentation layer is pretty important to do anything like that well.

Re: The “S” in MCP Stands for Security

#63

Post by kiitos »

neomantra wrote: post #17

Also the O is for Observability. I've been knee-deep in exploring and writing MCP servers this week. Most of the implementations, including my toy ones, do not have any auditing or metrics. Claude stores log output of the MCP servers, but that is geared more for debugging than for DevOps/SecOps. Culturally, the issues OP describes are a big problem for soft-tech people (muggles). On the subreddits for this stuff, peo…

> the issues OP describes are a big problem for soft-tech people (muggles)

What do you mean by this?

Re: The “S” in MCP Stands for Security

#64

Post by Findecanor »

yohbho wrote: post #46

MCP, master control program - this is about tron, ain't it?

I too expected a reuse of the full name when I first clicked...

"Master Control Program" was an operating system for Burroughs mainframes in the 1960s and 70s. That is probably where Tron got the name.

In the '90s, I used another "MCP" on the Amiga: it was a "commodity" that tweaked and patched things, similar to PowerToys on MS-Windows. And I think the author has said that he got the name from Tron.

Re: The “S” in MCP Stands for Security

#65

Post by ljm »

balls187 wrote: post #49

I deffo get the “checked in AWS keys because I didn't understand what I was doing” vibe with the adoption of AI tooling. I wonder if any AI coding tools will do similar things like curl rando scripts from the web and execute them.

I’ve spotted a few more subtle issues that would be unlikely to slip through code review, but can easily see a resurgence from vibe-coding and from a shift in early-stage hiring priorities towards career founding/‘product’ engineers.

It’s an easy tell for LLM-driven code because, to a seasoned engineer, it’ll always look like a strange solution to something, like handling auth or setting cookies or calling a database, that has been a done deal for a long time.

Re: The “S” in MCP Stands for Security

#69

Post by beefnugs »

jstanley wrote: post #8
anaisbetts wrote: post #3

These attacks are mostly just more examples of being on the wrong side of the airlock ( https://devblogs.microsoft.com/oldnewthing/20060508-22/?p=31... ). None of these involve crossing a privilege boundary, they just found a weird way to do something they could already do An MCP server is running code at user-level, it doesn't need to trick an AI into reading SSH keys, it can just....read the keys! The rest of these…

> None of these involve crossing a privilege boundary, they just found a weird way to do something they could already do It's slightly more subtle than that. The tool poisoning attack allows the provider of one tool to cause the AI to use another tool. So if you give the AI some random weather tool from some random company, and you also give the AI access to your SSH key, you're not just giving the AI your SSH key, y…

Nope still the same thing: all AI is insecure, you cant put untrusted unconfirmed text from anyone in through a secure airlock and let it run wild.

The answer is you need complete control over the text blob on the secure side, but then.... none of this works so throw it in the trash already

Re: The “S” in MCP Stands for Security

#70

Post by foolswisdom »

TeMPOraL wrote: post #58
wat10000 wrote: post #56

Earlier quoted context omitted.

It needs to treat that data as information . If there’s README says to download a tarball and unpack it, that might be phrased as an instruction, but it’s not the same kind of instruction as the “please install this library” from the user. It’s implicitly a “if your goal is X then you can do Y to reach that goal” informational statement. The reader, whether a human or an LLM, needs to evaluate that information to dec…

There is no hard distinction between "code" and "data". Both are the same thing. We've built an entire computing industry on top of that fact, and it sort of works, and that's all with most software folks not even being aware that whether something is code or data is just a matter of opinion.

I'm not sure I follow. Traditional computing does allow us to make this distinction, and allows us to control the scenarios when we don't want this distinction, and when we have software that doesn't implement such rules appropriately we consider it a security vulnerability.

We're just treating LLMs and agents different because we're focused on making them powerful, and there is basically no way to make the distinction with an LLM. Doesn't change the fact that we wouldn't have this problem with a traditional approach.

Post reply on HN