Payment-enabled MCP endpoints pass anonymous handshakes at 74.4%, above registry average

·1 views

A read-only scan by mcpreflight checked 293 x402 payment endpoints listed in the official MCP Registry by sending two anonymous JSON-RPC requests to each. Of these, 218 returned a clean handshake, a 74.4% pass rate, compared with a 48.8% baseline across the full registry. The researchers suggest commercial pressure, since a malformed payment challenge fails in front of paying customers, explains the stronger results. They caution that the figure is a single point-in-time measurement and may be fragile as payment volume and endpoint changes grow. The project re-runs its registry scan weekly and publishes its data and open-source tooling.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Running User JavaScript Under a Strict CSP Using eval()

A DEV Community post by Murray le Roux examines how to execute user-supplied JavaScript while operating under a strict Content Security Policy. The article is tagged with javascript, security, webdev, and csp topics. The post reportedly takes about 14 minutes to read. The excerpt provided does not include the body text describing the methods or conclusions. A full version of the article would be needed to produce an accurate four-to-five sentence summary.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

String Utility Belt sandboxes user JavaScript with layered iframe and CSP isolation

The developer of String Utility Belt, a browser tool for chaining text transformations, added a custom JavaScript step that lets users write their own functions. Because users often paste sensitive data such as JWTs, Kubernetes secrets, and production API keys, and pipelines are shared via links, the code needed strong isolation. The solution runs user code inside a four-layer sandbox: a srcdoc iframe with an opaque origin, a strict per-frame Content-Security-Policy that blocks all network access, and a Web Worker that can be terminated when it exceeds its time limit. Each run uses a fresh frame that is removed afterwards, so nothing persists between runs. The article describes how this strict CSP initially broke the sandbox when it was enabled.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fixing YouTube's 'Sign in to confirm you're not a bot' error on cloud servers

Developers running transcript code on AWS, Vercel, Render, or VPS hosts often hit a LOGIN_REQUIRED error saying the request looks like a bot. The article explains that YouTube flags cloud and datacenter IP ranges as scrapers, so the problem comes from the server's location rather than the code itself. It advises first checking the error reason, since some failures like private or age-restricted videos cannot be fixed by retrying. Suggested remedies include installing a JavaScript runtime for yt-dlp, switching YouTube client types, using cookies from a throwaway account, PO tokens, or residential proxies, each with trade-offs.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Detecting Silent Failures: API Error Rates, Cron Success Timestamps, and Alert Testing

A DEV Community guide argues that reliable failure detection depends on signals that distinguish genuine outcomes from mere completed requests. It recommends counting API outcomes by category, recording whether scheduled jobs meet a completion check, and tracking the timestamp of the last verified success to catch jobs that never ran. The author suggests running the poller outside the observed job, with a deadline and a completion predicate taken from the API contract. It also warns against putting identifiers, tokens, or raw error text into metric labels, since these create high cardinality and can expose sensitive data. Diagnostic detail is better kept in access-controlled logs, with metrics, logs, and traces each handling a distinct job.

0 comments Read more at DEV Community