I Audited the MCP SDK OAuth Fix: 3 Checks Upgrading Misses

·25 views

Last week the official MCP Python SDK shipped a fix for a credential theft bug, and the fix itself has a trap that a version check will not catch. I was researching the disclosure for my own MCP servers and the remediation notes stopped me cold: patch the package, and part of the vulnerability survives unless you also change how you construct your OAuth providers. Here is the short version. On September 28, a GitHub advisory landed on the modelcontextprotocol python-sdk repo: GHSA-qx49-fqc8-xw99, titled "OAuth client could send credentials to an authorization server chosen by the MCP server."

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Paper Walk app generates offline prompts for outdoor exploration

A developer has created Paper Walk, a web app that generates printable walk cards. The app uses a small open-weight AI model running locally on a user's computer to produce prompts based on time, location, and mood. After a walk, users can save a note, which the app uses to personalize future prompts. The project was built as a submission for the Hacktoberfest Open-Source AI Challenge and is designed to encourage screen-free outdoor activity. All data remains on the user's device, ensuring privacy.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Browser-Based Image Editing Tools Face Memory and Stability Hurdles

Developers built ClearPix, a suite of media cleanup tools like watermark removal and image upscaling that run entirely in a user's web browser. Running these AI models locally presents significant challenges, primarily due to high memory consumption and unstable WebGPU drivers. The team selected specific model variants based on performance benchmarks rather than academic reputation, prioritizing browser efficiency over raw computational power. A key optimization involves tiled inference to process large images without crashing the browser tab.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Database backup gaps cause multi-day recovery effort after admin error

An IT manager requested a partial database restore after an admin accidentally blanked 60,000 records. The platform's automated backups captured only database dumps, not the full application state including files and configurations. Restoring the single affected table required four days of manual work because data, metadata, and attachments were interdependent. The incident revealed that backing up only structured data ignores critical components like file storage and search indexes. This highlights the risk of assuming database backups alone ensure full system recovery.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open AI system forecasts construction delays using on-site cameras and data

A new open reference architecture proposes using AI to forecast schedule slips at construction sites. The system ingests data from multiple sources like crane logs and GPS into a central Kafka backbone, creating a unified object model. It employs edge devices with computer vision for real-time detection and a large language model for forecasting and planning. The architecture is designed for a large project in Saudi Arabia, addressing challenges like high temperatures and multilingual workforces. All components, including the model weights and object definitions, are released under permissive open-source licenses.

0 comments Read more at DEV Community