SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

Security risks in MCP servers: why you should scan before connecting to AI agents

0
·1 views

MCP servers connected to AI agents like Claude Desktop or Cursor can pose serious security risks, as they run locally with full user permissions and access to environment variables including sensitive credentials. Unlike npm packages, these servers carry an additional threat vector: tool descriptions that are fed directly into the AI model's context and can contain prompt injection instructions, exfiltration directives, or hidden Unicode characters. Security researchers have identified real-world patterns where malicious tool descriptions instruct models to ignore user commands, silently send data to external endpoints, or hide their own existence from users. A basic security review involves checking which shell commands and network tools the server invokes, as well as scanning tool metadata for suspicious phrases before the server is ever executed. Tools like MCPGuard can automate this static analysis, helping developers catch threats in seconds without requiring a dedicated security team.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Token Cost of AI Tool Discovery: When Agent Context Overhead Actually Matters

A developer measured the token cost of injecting tool definitions into an AI model's context on every call, using a tokenizer-based harness without requiring a live LLM. The study found that a small three-tool server costs just 277 tokens per model call, making optimization pointless at that scale. However, costs scale linearly with tool count and description verbosity — 100 verbose tools consume over 20,000 tokens per call, totalling roughly 400,000 tokens across a 20-call agent task. Curating five relevant tools from a set of 100 cuts context cost by approximately 95 percent. The key finding is that the real cost driver is not discovery versus static manifests, but how many tool definitions sit in context and how verbosely they are written.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Tiny On-Device AI Models Struggle Most With Children's Speech, Posing Product Dilemma

Developers building WhyWave, a voice companion for children aged three to five, discovered that smaller AI models — compact enough to run on a smartphone — perform significantly worse at recognising children's speech compared to adult speech. Legal constraints complicate the alternative: Apple's App Store guidelines bar kids' category apps from sending personally identifiable information to third parties, and a child's voice qualifies as such under COPPA's definition in 16 CFR § 312.2. Major AI vendors add further restrictions, with Google prohibiting use of its generative APIs in products directed at under-18s, while OpenAI and Anthropic impose strict conditions including zero data retention and age verification. Processing audio entirely on-device sidesteps these legal hurdles, since audio that never leaves the device is never 'collected' under COPPA and no third-party vendor terms apply. Recent benchmarks show on-device models like Whisper Large v3 Turbo and lightweight alternatives such as Moonshine are closing the gap with cloud systems on speed and accuracy, though their performance on children's voices remains a key unsolved challenge.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Developer Cuts AI API Costs by 61% Using Model Routing and Fallback Logic

A developer building an AI-powered app was spending $800 per month on OpenAI API calls despite having fewer than 500 active users. After auditing a week of LLM calls, they found that 62% of requests involved simple tasks like classification that did not require expensive flagship models. They implemented task-based model routing, directing simpler workloads to cheaper models such as GPT-4o-mini or Claude Haiku, which cost roughly 10 times less per token. A fallback layer was added to handle provider outages, and an API gateway was adopted to centralize routing, key management, and retry logic. Within three weeks, monthly costs fell by 61% while reliability improved and the codebase became simpler to maintain.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

116,181 Search Impressions but Only 9 Clicks: What the Data Reveals About Web Visibility

A website intelligence platform called AuditMe recorded 116,181 Google Search impressions over three months but generated only 9 clicks, yielding a visibility gap ratio of roughly 12,909 impressions per click. During a separate 27-day period, the same site logged 1,737 AI citation events, highlighting that search engines and AI systems measure visibility in fundamentally different ways. The data illustrates that a website passes through multiple distinct layers — from crawling and indexing to surfacing, citation, and conversion — and can succeed at one layer while failing at another. Neither metric alone tells the full story: AI citations do not automatically translate into clicks or revenue, just as high impression counts do not guarantee meaningful user engagement. The findings suggest that site owners need layer-by-layer diagnostics rather than a single aggregate visibility score to understand where their web presence is actually breaking down.

0 comments Read more at DEV Community
Security risks in MCP servers: why you should scan before connecting to AI agents · ShortSingh