Building secure MCP servers for clients — hardening the agentic layer against prompt injection, tool misuse, and privilege abuse. Field notes on MCP security, agentic safety, and shipping AI platforms.
Hugging Face's July 2026 breach: an attacker's agent rode an ordinary code-exec through an over-privileged worker. The defender's real takeaway: local-first, open-weights AI, integrated with your log sources and security tools, so your own forensics never get refused, leaked, or throttled.
The thinking behind mcploitable, a lab of deliberately vulnerable MCP servers covering the OWASP Agentic Top-10. How the boxes are built: faithful to real incidents, a two-plane attacker/victim split, an L0-L3 control ladder, and scoring by effect. Plus a few things I learned building it.
A stdio MCP server that runs fine in a terminal but 'won't connect' to the client is almost always writing logs to stdout. Stdout is reserved for JSON-RPC. Here's why one log line corrupts the protocol, and the one-line structlog fix.
Why security instructions in an MCP server's system prompt are theater, and where the real controls belong: a runtime endpoint allowlist, structured returns, and output scanning, all deterministic code between the model and the API. With the allowlist bug that re-opens the doors you closed.