MCP Solves AI Tool Discovery But Leaves Security Gaps for Developers to Fill

·1 views

The Model Context Protocol (MCP) has standardized how AI clients discover and invoke external tools, replacing fragmented, custom plugin systems with a common language. However, security experts warn that discoverability is not the same as authorization — a tool being listed does not mean it is safe or permitted to use. MCP does not natively enforce per-user permissions, least-privilege access, sandboxing, prompt-injection defenses, or approval workflows. Every tool description, schema, and result enters the AI model's context, making them potential attack surfaces for manipulation. Developers are advised to treat MCP servers as runtime plugins with real influence and to implement a dedicated policy gateway between agents and MCP servers.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Study: WebP at Quality 80–85 Beats High-JPEG Settings for Photos

A compression study tested 24 images from the standard Kodak reference suite, encoding each as JPEG and WebP across quality levels 20 to 95 and scoring results using the SSIM structural similarity metric. The findings show that most perceptible quality is gained early in the compression curve, with diminishing returns at higher settings — raising JPEG quality from 85 to 95 nearly doubles file size for an SSIM improvement of just 0.025. WebP consistently outperformed JPEG, delivering roughly 30% smaller files at equivalent perceived quality. Lossless formats cost approximately seven times the size of a quality-85 JPEG, making them impractical for most photographic use cases. Researchers recommend quality 80–85 in WebP as the practical sweet spot, while noting that the ideal setting varies by image content and is best determined through live preview rather than a fixed number.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

hls.js ESM builds skip the transmuxer worker by default, here is how to fix it

The ESM build of hls.js, introduced in version 1.4, does not bundle the transmuxer worker inline, meaning video transmuxing runs on the main thread unless a workerPath is explicitly configured. The default enableWorker: true setting is misleading, as it only signals intent to use a worker if available rather than confirming one is actually running. Developers can verify whether a worker is active by checking the browser's resource performance entries or the DevTools thread panel during playback. The fix involves passing a resolved URL for hls.worker.js via the workerPath option, with syntax varying slightly across bundlers such as Vite, webpack 5, and Next.js. Additionally, a PerformanceObserver tracking long tasks exceeding 50ms can help distinguish main-thread stalls from network-related buffering issues.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a React Native Video Upload That Survives App Backgrounding

A standard fetch() upload in React Native fails silently when the OS suspends or kills the app mid-transfer, leaving no error and no settled promise. To work around this, developers can persist upload state in a SQLite database and use a native background session — iOS Background URLSession and an Android foreground service — to handle the actual file transfer. The approach requires writing the file body to disk first, since iOS background sessions do not support in-memory data or stream bodies. On Android, targeting version 14 and above requires declaring a dataSync foreground service type, while Android 15 introduces a 6-hour daily cap on such services. The full implementation, written against Expo SDK 54 and SDK 55, runs to roughly 150 lines and reconciles upload state with the server when the app returns to the foreground.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Build a Repeatable Banding Test for Video Ladders Using FFmpeg

Video banding debates are often inconclusive because engineers test on different footage, making standardized synthetic testing a more reliable approach. A structured method using FFmpeg involves generating a noiseless 1080p synthetic gradient and encoding it four ways: naive 8-bit, 8-bit debanded, 10-bit filter graph with explicit dithering, and 10-bit AV1. Each encoding method reveals a different layer of the banding problem, with the 10-bit filter chain approach — using error diffusion dithering and grain-preserving encoder settings — identified as the step most commonly skipped. The AV1 10-bit encode sidesteps quantisation issues entirely without any debanding filter. A contrast-amplification step using FFmpeg's eq filter is also recommended to make banding artifacts visually obvious during quality review.

0 comments Read more at DEV Community