5 ms·

I feel like I slept for a day and now MCPs are everywhere... I don't know what MCPs are and at this point I'm too afraid to ask.

jastuk 2y ago
And the worst part is that it opens a pandora's box of potential exploits; https://elenacross7.medium.com/%EF%B8%8F-the-s-in-mcp-stands-for-security-91407b33ed6b https://elenacross7.medium.com/%EF%B8%8F-the-s-in-mcp-stands...
- halJordan 2y ago
  At the risk of it sounding like i support theft; the automobile, you know, enabled the likes of Bonnie and Clyde and that whole era of lawlessness. Until the fbi and crossing county lines became a thing. So im not sure id give up the sum total progress of the automobile just because the first decade was a bad one
- joshwarwick15 2y ago
  Most of these are not a real concern with remote servers with Oauth. If you install the PayPal MCP MCP server from im-deffo-not-hacking-you.com than https://mcp.paypal.com/sse https://mcp.paypal.com/sse its the same sec model as anything else online... The article also reeks of LLM ironically
  - tuananh 2y ago
    it still is. if user has 1 bad tool, it's done! https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks https://invariantlabs.ai/blog/mcp-security-notification-tool...
    - joshwarwick15 2y ago
      Its the same security model as NPM/left pad yep, but consumers still use electron apps? It's a novel attack method, but its not a novel attack surface
- TeMPOraL 2y ago
  That's not fault of MCP though, that's the fault of vendors peddling their MCPs while clinging to the SaaS model. Yes, MCP is a way to streamline giving LLMs ability to run arbitrary code on your machine, however indirectly. It's meant to be used on "your side of the airlock", where you trust the things that run. Obviously it's too powerful for it to be used with third-party tools you neither trust nor control; it's not that different than downloading random binaries from the Internet. I suppose it's good to spell out the risks, but it doesn't make sense blaming MCP itself, because those risks are fundamental aspects of the features it provides.
  - kmacdough 2y ago
    It's not blame, but it's a striking reality that needs to be kept at the forefront. It introduces a substantial set of novel failure modes, like cross-tool shadowing, which aren't obvious to most folks. Making use of any externally developed tooling — even open source tools on internal architecture — requires more careful consideration and analysis than most would expect. Despite the warnings, there will certainly be major breaches on these lines.
oulipo 2y ago
It's just a way to provide a "library of methods" / API that the LLM models can "call", so basically giving them method names, their parameters, the type of the output, and what they are for, and then the LLM model will ask the MCP server to call the functions, check the result, call the next function if needed, etc Right now if you go to ChatGPT you can't really tell it "open Google maps with my account, search for bike shops near NYC, and grab their phone numbers", because all he can do is reply in text or make images with a "browser MCP" it is now possible: ChatGPT has a way to tell your browser "open Google maps", "show me a screenshot", "click at that position", etc
- throwaway314155 2y ago
  > with a "browser MCP" it is now possible: ChatGPT has a way to tell your browser "open Google maps", "show me a screenshot", "click at that position", etc It seems strange to me to focus on this sort of standard well in advance of models being reliable enough to, ya know, actually be able perform these operations on behalf of the user with any sort of strong reliability that you would need for widespread adoption to be successful. Cryptocurrency "if you build it they'll come" vibes.
  - acedTrex 2y ago
    The speed that every major LLM foundational model provider has jumped on this bandwagon feels VERY artificial and astro turfy...
    - XCSme 2y ago
      Maybe because the LLM improvements haven't been that good in the last year, they needed some new thing to hype it/market it. EDIT: Don't get me wrong, the benchmark scores are indeed higher, but in my personal experience, LLMs make as many mistakes as they did before, still too unreliable to use for cases where you actually need a factually correct answer.
      - acedTrex 2y ago
hedgehog-ai 2y ago
I know what you mean, I think MCP is being widely adopted but it's not grassroots.. its a quick entry to this market by an established AI company trying to dominate the mind/market share of developers before consensus can be reached developers.
orbital-decay 2y ago
MCP is a standard to plug useful tools into AI models so they can use them. The concept looks confusingly reversed and non-obvious to a normal person, although devs don't see this because it looks like their tooling.
whalesalad 2y ago
It’s RPC specifically for an LLM. But yes it’s the new soup de jour trend sweeping the globe.

jastuk 2y ago

And the worst part is that it opens a pandora's box of potential exploits; https://elenacross7.medium.com/%EF%B8%8F-the-s-in-mcp-stands-for-security-91407b33ed6b https://elenacross7.medium.com/%EF%B8%8F-the-s-in-mcp-stands...

halJordan 2y ago
At the risk of it sounding like i support theft; the automobile, you know, enabled the likes of Bonnie and Clyde and that whole era of lawlessness. Until the fbi and crossing county lines became a thing. So im not sure id give up the sum total progress of the automobile just because the first decade was a bad one
joshwarwick15 2y ago
Most of these are not a real concern with remote servers with Oauth. If you install the PayPal MCP MCP server from im-deffo-not-hacking-you.com than https://mcp.paypal.com/sse https://mcp.paypal.com/sse its the same sec model as anything else online... The article also reeks of LLM ironically
- tuananh 2y ago
  it still is. if user has 1 bad tool, it's done! https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks https://invariantlabs.ai/blog/mcp-security-notification-tool...
  - joshwarwick15 2y ago
    Its the same security model as NPM/left pad yep, but consumers still use electron apps? It's a novel attack method, but its not a novel attack surface
TeMPOraL 2y ago
That's not fault of MCP though, that's the fault of vendors peddling their MCPs while clinging to the SaaS model. Yes, MCP is a way to streamline giving LLMs ability to run arbitrary code on your machine, however indirectly. It's meant to be used on "your side of the airlock", where you trust the things that run. Obviously it's too powerful for it to be used with third-party tools you neither trust nor control; it's not that different than downloading random binaries from the Internet. I suppose it's good to spell out the risks, but it doesn't make sense blaming MCP itself, because those risks are fundamental aspects of the features it provides.
- kmacdough 2y ago
  It's not blame, but it's a striking reality that needs to be kept at the forefront. It introduces a substantial set of novel failure modes, like cross-tool shadowing, which aren't obvious to most folks. Making use of any externally developed tooling — even open source tools on internal architecture — requires more careful consideration and analysis than most would expect. Despite the warnings, there will certainly be major breaches on these lines.

oulipo 2y ago

It's just a way to provide a "library of methods" / API that the LLM models can "call", so basically giving them method names, their parameters, the type of the output, and what they are for, and then the LLM model will ask the MCP server to call the functions, check the result, call the next function if needed, etc Right now if you go to ChatGPT you can't really tell it "open Google maps with my account, search for bike shops near NYC, and grab their phone numbers", because all he can do is reply in text or make images with a "browser MCP" it is now possible: ChatGPT has a way to tell your browser "open Google maps", "show me a screenshot", "click at that position", etc

throwaway314155 2y ago
> with a "browser MCP" it is now possible: ChatGPT has a way to tell your browser "open Google maps", "show me a screenshot", "click at that position", etc It seems strange to me to focus on this sort of standard well in advance of models being reliable enough to, ya know, actually be able perform these operations on behalf of the user with any sort of strong reliability that you would need for widespread adoption to be successful. Cryptocurrency "if you build it they'll come" vibes.
- acedTrex 2y ago
  The speed that every major LLM foundational model provider has jumped on this bandwagon feels VERY artificial and astro turfy...
  - XCSme 2y ago
    Maybe because the LLM improvements haven't been that good in the last year, they needed some new thing to hype it/market it. EDIT: Don't get me wrong, the benchmark scores are indeed higher, but in my personal experience, LLMs make as many mistakes as they did before, still too unreliable to use for cases where you actually need a factually correct answer.
    - acedTrex 2y ago

hedgehog-ai 2y ago

I know what you mean, I think MCP is being widely adopted but it's not grassroots.. its a quick entry to this market by an established AI company trying to dominate the mind/market share of developers before consensus can be reached developers.

orbital-decay 2y ago

MCP is a standard to plug useful tools into AI models so they can use them. The concept looks confusingly reversed and non-obvious to a normal person, although devs don't see this because it looks like their tooling.

whalesalad 2y ago

It’s RPC specifically for an LLM. But yes it’s the new soup de jour trend sweeping the globe.