Developer builds open-source security scanner for MCP servers amid rising CVEs

·2 views

A developer has released sentrymcp, an open-source security scanner for Model Context Protocol (MCP) servers, built in Rust and available under the MIT license. The tool was created after the developer found no purpose-built scanner existed, despite over 40 CVEs disclosed against MCP implementations this year. It performs static analysis to detect path traversal, command injection, missing authentication, and tool poisoning, while a runtime proxy mode monitors for 'rug pulls' — cases where a server silently alters a tool's description after user approval. Research from Endor Labs found that 82% of over 2,600 real MCP implementations use file operations prone to path traversal, and nearly 40% of scanned servers lack authentication entirely. The project can be run via a Docker one-liner, and its findings are ranked by severity with references to CWEs or the OWASP MCP Top 10.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Developer builds 59 privacy-first browser tools in vanilla JS with zero dependencies

A developer has publicly launched Antigravity Tools, a collection of 59 free, browser-based utilities built entirely in vanilla JavaScript with no external dependencies, backend servers, or analytics. The project was motivated by privacy concerns with popular online tools, such as JWT decoders and regex testers, which can log user data on remote servers. All operations run locally in the browser using native APIs including Web Crypto, Canvas, Web Audio, and IndexedDB. The toolkit covers a wide range of developer needs, including JWT inspection, RSA key generation, JSON formatting, cURL conversion, regex testing, and AI prompt utilities. The tools are available for free at antigravitytools.app.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Six Design Controls for Reliable Localized Password Reset Email Delivery

A technical guide outlines six key controls for building secure, localized password reset email systems for media platforms. The approach centers on keeping HTML templates in versioned, application-owned source code rather than provider-hosted editors, ensuring preview and production emails use the same rendering path. Localization requires an explicit fallback chain with approved catalog revisions, and reset URLs must be generated by the application rather than embedded in translation files. A durable outbox with idempotency keys and expiry-aware retry limits ensures delivery evidence is preserved and expired links are not resent. The framework also mandates plain-text alternatives alongside HTML to cover all mail clients and avoid gaps in delivery coverage.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

5 Messaging Patterns That Keep Distributed Services Reliable at Scale

Modern distributed systems like food delivery platforms often rely on asynchronous messaging instead of direct service calls, making them more resilient to failures. Key patterns include message queues that hold requests when a receiver is down, and publish-subscribe topics that fan a single event out to multiple independent consumers. Competing consumers allow many workers to drain a shared queue simultaneously, enabling rapid scaling during traffic spikes. A dead-letter queue captures repeatedly failing messages so one corrupt entry cannot block the entire pipeline. Idempotent consumer design ensures that processing the same message more than once — a common occurrence due to network retries — produces no duplicate side effects such as double-charging a customer.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build Reliable Async Batch Summarization for Node.js Support Triage

A software architecture guide outlines best practices for handling multi-document summarization in Node.js-based customer support triage systems. The approach treats each batch summarization task as a durable async job, requiring tenant and document identities to be attached before submission and tracked throughout processing. Developers are advised to write accounting records before submitting work, join results by document ID rather than array position, and verify completeness before marking any export as ready. The architecture separates the cost ledger from the content store and uses deterministic storage keys to make repeated exports idempotent and missing results detectable. The guide emphasizes that request timeouts, terminal job states, and successful downloads each carry distinct meanings and must not be conflated to avoid support and accounting failures.

0 comments Read more at DEV Community