Безопасность MCP: уязвимый сервер MCP с тремя недостатками и их исправлениями
DEV · 15.11.2026 · 00:47
Мы создали небольшой сервер MCP с уязвимым и исправленным режимами и протестировали три недостатка. Результаты тестов показали, что в уязвимом режиме все проверки атак прошли успешно, в то…
Оригинал
MCP security: a vulnerable MCP server you can run, with three flaws and their fixes
An MCP server gives an AI agent a set of tools, such as "add two numbers" or "fetch a report". MCP security is the work of making sure each tool does only what the calling user may do. We built a small MCP server with a vulnerable mode and a fixed mode, and wrote tests for three flaws. We ran them on 12 November 2026 and again on 13 November 2026, and both runs gave the same 16 results. In vulnerable mode all 4 attack checks succeeded. In fixed mode all 4 were blocked. The 3 control checks gave