MarketNow audited 8,764 MCP servers using gVisor, flagging critical security risks

·1 views

MarketNow, a marketplace for MCP servers, has completed security audits of 8,764 servers using a multi-layer framework that includes a gVisor (runsc) sandbox at its core. Of the 206 servers that reached the gVisor stage, 69 passed cleanly, 103 failed to start due to unimplemented syscalls, and 6 were rated high-risk with critical findings; 3 servers were removed for leaking environment variables. During audits, one server attempted a ptrace() call and another attempted bpf(), both blocked by gVisor returning permission or unsupported-syscall errors. The team notes that roughly 50% of MCP servers fail under gVisor due to syscall incompatibility, and uses a strict seccomp profile as a fallback when gVisor is unavailable. MarketNow plans to upgrade to Firecracker microVM isolation by Q1 2027, pending the need for KVM access currently unavailable on standard CI runners.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Upfront Software Design Saved a Solo AI Project from Costly Rewrites

A developer building DumbQuestion.ai found that early architectural discipline paid off when adding a new 'Startup Roast' feature to the platform. Rather than hardcoding values, configurable constants and modular prompt handling meant adapting to longer startup pitch inputs required iteration, not a full rewrite. The new feature takes a startup pitch, roasts it with sarcasm, and adds a market-aware reality check by running a preliminary web search before generating output. Using the AI productivity startup Vida as a test case, the enriched context produced sharper, more informed critique than a generic roast would have. The developer argues this approach scales beyond solo projects, potentially saving enterprises significant costs in AI token spend and rework when extending agentic AI systems.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Nuxt 4 in 2026: A Mature Full-Stack Vue Framework Worth Reconsidering

Nuxt, the full-stack framework built on Vue.js, has undergone significant development over the past two years, with Nuxt 4 releasing in July 2025 and the project now at version 4.4.x. A fifth major version powered by the new Nitro v3 engine is already in development. Central to Nuxt's appeal are two design principles: convention-over-configuration file routing and auto-imports, and Nitro, a platform-agnostic server engine that compiles API routes into deployable output compatible with AWS Lambda, Cloudflare Workers, Vercel Edge, Bun, and standard Node servers without code changes. Nitro's built-in storage abstraction layer further allows developers to switch between filesystem, Redis, S3, and Cloudflare KV backends using a unified API. While Next.js remains the dominant full-stack JavaScript framework, Nuxt's thoughtful architecture makes it a compelling alternative for teams starting new projects or those already working within the Vue ecosystem.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Open-Source Framework Treats AI Context Windows as Managed Budgets, Not Catch-Alls

A developer has released an open-source Context Engineering Framework designed to bring discipline to how AI coding assistants load and use information within their context windows. The framework, hosted in a growing dot-files repository, supports six major AI tools including Claude Code, Cursor, Windsurf, GitHub Copilot, Gemini, and OpenAI Codex, and currently includes 24 agents and 53 skills. At its core, a dedicated context-engineer agent produces a structured 'context-manifest' before any pipeline work begins, explicitly scoping which files, prior decisions, and knowledge items are relevant rather than letting context accumulate by accident. The framework also distinguishes between context, memory, and learning as separate concerns, and introduces 'context decay' — summarizing artifacts older than two pipeline phases to roughly 200 words instead of loading them verbatim. The goal is to prevent downstream agents in multi-step pipelines from being burdened by stale or irrelevant material that degrades output quality.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Generative Engine Optimization: How Developers Can Get Cited by AI Answer Engines

Generative Engine Optimization (GEO) is the practice of structuring web content so AI tools like ChatGPT and Perplexity quote it directly in their responses, rather than merely ranking it in search results. The term originates from a peer-reviewed study presented at KDD 2024 by researchers from Princeton, Georgia Tech, and IIT Delhi, which found that adding statistics to a page boosted AI visibility by up to 41%. Unlike traditional SEO guides aimed at large marketing teams, GEO for individual developers centers on a few practical steps: answering the core question within the first 40–60 words, phrasing headings as questions, and ensuring each section is self-contained enough to be understood out of context. Developers are also advised to include specific, sourced statistics rather than vague claims, as AI engines are more likely to cite precise, verifiable information. Finally, updating the robots.txt file to explicitly allow citation-focused bots such as OAI-SearchBot and PerplexityBot is recommended, as many site owners never configure this file.

0 comments Read more at DEV Community