3 ms·
> MCP initially didn’t define an auth spec and now that they have people don’t like it. Just wrap it in an SSH tunnel or a HTTPS websocket > MCP servers can r
by dheera 2y ago
> MCP initially didn’t define an auth spec and now that they have people don’t like it.
Just wrap it in an SSH tunnel or a HTTPS websocket
> MCP servers can run (malicious code) locally.
Just run it in a Docker container
- Sayrus 2y ago> Just run it in a Docker container You should probably read the original article in the footnotes of OP's article: https://equixly.com/blog/2025/03/29/mcp-server-new-security-nightmare/ https://equixly.com/blog/2025/03/29/mcp-server-new-security-... While a container will surely protect you from those, it will also prevent you using the features implemented by those MCP Servers.
- Havoc 2y agoContainers are usually considered pretty weak security at best. Especially since you don’t always control what the user does with it (docker va rootless podman etc)
- senko 2y ago>> MCP initially didn’t define an auth spec and now that they have people don’t like it. > Just wrap it in an SSH tunnel or a HTTPS websocket I assume this is sarcasm, but if not (and for people that take it at face value), it fundamentally misunderstands what auth is used for.