SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

I Audited the MCP SDK OAuth Fix: 3 Checks Upgrading Misses

0
·1 views

Last week the official MCP Python SDK shipped a fix for a credential theft bug, and the fix itself has a trap that a version check will not catch. I was researching the disclosure for my own MCP servers and the remediation notes stopped me cold: patch the package, and part of the vulnerability survives unless you also change how you construct your OAuth providers. Here is the short version. On September 28, a GitHub advisory landed on the modelcontextprotocol python-sdk repo: GHSA-qx49-fqc8-xw99, titled "OAuth client could send credentials to an authorization server chosen by the MCP server."

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

I Read Claude's Biology Discovery as a Pipeline: 5 Lessons

Anthropic posted on September 23 that Claude agents found a new enzyme system hiding in phage DNA. The numbers in the post: roughly 950 agents, 21 hours, 210 million tokens, one giant database of DNA sequences. One agent noticed a repeating pattern next to a gene that looked odd. Humans did the lab work, named the system ART, and released a pre-print. When I checked around 1 PM Singapore time the Hacker News thread sat at 567 points and 588 comments, and most of the fight is about one word: discovery.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

The BIN table said debit. The issuer said credit.

Added card-surcharging logic for a US merchant: debit cards skip the 3% fee, credit cards get it, per the usual state rules. Classification ran off a static BIN range table refreshed quarterly from our processor. Surcharge complaints started trickling in — cardholders insisting their debit card got charged a credit surcharge. Pulled the flagged transactions: roughly 1 in 180 had a BIN that our table listed as credit, but the issuer's own authorization response carried a debit indicator in the response fields. Turns out prepaid and co-branded cards get reissued under ranges that shift between d

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Minimalist Backend Automation Techniques: An Engineer's Insight

Minimalist Backend Automation Techniques: An Engineer's Insight Here's the brutal truth: most tech solopreneurs eventually drown in a sea of server crashes and API limits, suffocating under the weight of their own systems. While the tech landscape offers vast potential for innovation and efficiency, the road to automation is often cluttered with obstacles that require meticulous navigation. For those navigating these technical waters, the promise of streamlined backend operations offers a beacon of hope. Entrepreneurs in the tech world are all too familiar with the intricacies of backend opera

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

SFTP Explained: Secure File Transfers Over SSH

Need to move files to a server without exposing a separate file-transfer service? If the server offers OpenSSH, you may already have what you need: SFTP, a file-transfer protocol that runs over SSH. The name is easy to misread. SFTP is not FTP with encryption added. It uses SSH’s secure connection for file operations such as listing directories, uploading, downloading, and renaming files.

0 comments Read more at DEV Community