Hacker News new | ask | show | jobs
by belschak 16 days ago
The application-level visibility point matches my experience. I removed an MCP server a while back because its tool descriptions quietly told the agent to prefer it as the primary search tool over the built-in one. Not a vulnerability, no leaked secrets, just the vendor steering agent behavior in a way you only notice if you read the raw tool definitions. Does mcp-xray flag that kind of prompt-level steering in tool descriptions, or is it focused on classic vulns?
1 comments
XiaHua 16 days ago
That's a great example. It's exactly the kind of behavior we think deserves more attention. It's not a traditional vulnerability but it can significantly influence an agent's decision-making.

Today, mcp-xray (https://github.com/traceforce/mcp-xray) can be used to dynamically (not just statically) test against your MCPs. It can detect security vulnerabilities such as code execution, SSRF, path traversal, authorization bypass, input injection, DoS etc. You can find us at demo labs during DEF CON this year. That said, we think behavioral influence is an important problem and it's an area we're interested in exploring next.

link
cammcdingle 16 days ago
I work at Speakeasy where we do a similar thing with the AI control plane (https://www.speakeasy.com/product/ai-control-plane), and we just rolled out on-device agents for the same reason.

I think the point a few people are making is right that its not sufficient to be the best at one layer like the device endpoint. AI governance needs to be coordinated over a number of surfaces. We started with an MCP gateway and drilled down to on-device agents. I imagine you might end up doing the same the other way around.

link
XiaHua 16 days ago
Yes you are spot on! On-device agents can only do so much. We integrate with popular gateways such as Kong to bring MCP controls. We primarily manage the registries for MCPs with vulnerabilities that gateway companies don't do today.
link
XiaHua 16 days ago
oh and to add on this, MCP gateways work mostly with remote MCPs only. For the stdio ones, we still need local agents to take care of the controls.
link
simplesagar 16 days ago
Wrote a bit more about our remote MCP approach here

https://x.com/sagar_batchu/status/2077800956817743927?s=46&t...

link