4 ms·
If you replace the word "LLM" in your reply with "web browser", I think you'll see that the situation we're in with MCP servers isn't truly novel. There are lo
by spoaceman7777 1y ago
If you replace the word "LLM" in your reply with "web browser", I think you'll see that the situation we're in with MCP servers isn't truly novel.
There are lots of tools to handle the many, many programs that execute untrusted code, contact untrusted servers, etc., and they will be deployed more and more as people get more serious about agents.
There are already a few fledgling "MCP security in a box" projects getting started out there. There will be more.
- calrain 1y agoYes, this is just 'your code' if you're writing your own MCP code, but it's also 'Googles' code if you're using their MCP service in front of GMail. As with all code reviews, supply chain validation, CVE scanning, SNYK, whatever, definitely keep doing that for your home brew MCP implementation. For the commercial stuff, then that falls under the terms of service umbrella that covers all the stuff your company is still using from them. This article from CyberArk seemed to be fear mongering, not really educating people on writing better code. Not sure what their angle is, unless they are about to deliver a MCP Server service.
- akoboldfrying 1y ago> If you replace the word "LLM" in your reply with "web browser", I think you'll see that the situation we're in with MCP servers isn't truly novel. Oh I agree 100%, and even pointed this out myself in other comments.