Re-run of MCP tool-poisoning scanner benchmark adds two scanners and 14,933 npm/PyPI tool lists

·4 views

The team behind the WARDEN MCP scanner repeated its earlier comparison, expanding it from three scanners to five and from 986 remote servers to 14,933 npm and PyPI tool lists. All scanners were run in a gVisor container with networking disabled. WARDEN's ruleset update from v10 to v12 produced identical verdicts on every test set, and the two other scanners reproduced their earlier results exactly. The authors also checked that no rules written after v10 had seen the held-out benchmark data, finding no overlap. Several hosted tools were excluded because they send servers to external services for scoring, which prevents an offline comparison.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Migrating ledgers: tying opening balances to bank statements and uncleared items

When a business moves its books to a new provider, the opening ledger starts from the old provider's closing balance sheet. Each bank and card balance must match the bank's printed statement for the cutover date, adjusted for uncleared items such as an uncashed check. The author's rule is that the difference must be zero, and any unexplained gap signals a problem in the old books. The approach uses Decimal arithmetic in Python to avoid rounding errors that could mimic real discrepancies. If a gap cannot be explained, the advice is to trace back month by month to find where it first appeared rather than plugging it to equity.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

InboxWall: Local MCP Server Sanitizes Email HTML to Block Prompt Injection

InboxWall is an open-source Model Context Protocol server that cleans email HTML before an AI agent reads it, guarding against prompt injection. Attackers can hide instructions in emails using invisible CSS text, manipulative Unicode characters, or HTML comments that only appear in raw source. The tool exposes a single function that takes raw email HTML and returns plain text with styles, scripts, hidden characters, comments, and risky attributes removed. It runs entirely on the user's own machine, so email content is never sent to a third-party service, though the agent must manage the server as a separate process. The project's core design choice is to treat sanitization as a security boundary outside the language model's trust zone.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Akiflow's Time-Blocking Design Reveals Scheduling Primitives Useful for AI Agents

Akiflow, a tool that merges tasks with calendar availability, has drawn developer attention after its YC launch and a Hacker News discussion. The article argues that the infrastructure behind its drag-and-drop interface resembles what AI agents need to schedule their own execution windows. It highlights three challenges: orchestrating calendar APIs with differing sync latencies and rate limits, solving scheduling as a constraint-satisfaction problem, and structuring tasks with machine-readable metadata. The author proposes a layered architecture for agent scheduling that includes a scheduling engine, a task metadata store, calendar sync adapters, and an execution runtime.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Researchers Find Implants in Ledger and Trezor Devices That Read Screens to Steal Seeds

Reporting this month described hardware implants found in Ledger and Trezor wallets that evolved across five design generations. Rather than breaking the Secure Element, the implants monitor the device display, capture recovery seed words as they appear, and transmit them over a built-in cellular modem. Ledger confirmed the implant does not alter its chip, operating system, or transactions. Security researchers say Ledger was warned months earlier but did not proactively alert users, and analytics firms link the activity to roughly 315 drained accounts and about $102 million in cryptocurrency.

0 comments Read more at DEV Community