FastMCP's October advisories: which versions to run and what upgrading misses
FastMCP published 16 advisories in five days, including client-side code execution. The versions that fix them, and the steps an upgrade won't do.
Blog tag
#MCP
The Model Context Protocol: servers, clients, tools and the ecosystem around them.
Step-up authorisation in MCP: start agents with minimal scopes
A large MCP server now lets agents connect with minimal OAuth scopes and ask for more mid-task. How the specification's step-up flow works, and what to check.
5 min read
MCP servers over HTTP: the SDK resource limits you now have to set
Recent MCP SDK advisories added size, batch, session and validation limits to HTTP servers. Some need a code change, not just an upgrade. What to check.
An MCP login link that ran code: opencode's fix shipped without an advisory
A remote MCP server could run commands on Windows and WSL machines through opencode's OAuth flow. The fix is out, but no CVE or advisory will flag it.
5 min read
Agent skills that point at bad domains: what a 5.5 million URL scan found
Manifold checked every URL in public agent skills, MCP servers and plugins; 121 components use a high-risk domain. What that means for reviewing skills.
What an agent approval actually approves: effect binding and trusted cards
A new preprint audits ten agent runtimes and finds approvals that don't bind to what executes. The findings, the proposed fix, and what to ask of your tools.
An MCP server entry is a command: three October flaws and headless runs
Junie CLI, ZCode and the Claude Agent SDK all had paths from untrusted input to an MCP server launch. What they share, and where trust prompts disappear.
6 min read
Stateless MCP in production: running old and new protocol versions side by side
Azure MCP Server 3.0 and Red Hat's MCP gateway now speak the 2026-07-28 protocol. What their releases show about version negotiation, lost features and audit.
MCP Server Cards: what discovery before connection means for operators
SEP-2127 lets remote MCP servers publish a static card that clients find before connecting. What a card holds, what it leaves out, and the rules to set now.
5 min read
MCP SDKs can now check a token's audience, but only if you turn it on
The MCP Python and TypeScript SDKs accepted tokens issued for other services. The fix is opt-in: what to upgrade, what to configure and how to test it.
Protocol pivoting: when MCP trust leaks into another agent protocol
Research on protocol pivoting shows how an injected instruction can cross from MCP into agent-to-agent delegation. Why per-protocol fixes miss it.
MCP Python SDK redirected custom headers off-origin
A medium-severity flaw in the MCP Python SDK followed cross-origin redirects and forwarded custom API keys. How it differs from the TypeScript OAuth issuer bug.
Browse by tag
- #Security (54)
- #Agents (40)
- #AI coding tools (37)
- #LLM costs (23)
- #MCP (16)
- #Evaluation (14)
- #Observability (12)
- #Compliance (11)
- #Enterprise (9)
- #Platform engineering (9)
- #Data privacy (8)
- #DevOps (7)
- #Model routing (7)
- #Open-weight models (7)
- #Research (7)
- #Tutorials (6)
- #Code review (4)
- #Developer productivity (4)
- #Guardrails (4)
- #OpenTelemetry (4)
- #Budgets (3)
- #Networking (3)
- #Prompt engineering (3)
- #Self-hosting (3)
- #MCP gateway (2)
- #Release notes (1)
- #Skills (1)
- #Testing (1)