Most CISOs are intentionally turning a blind eye to MCP so they don’t get blamed for slowing AI efforts.
But putting oath tokens in config/mcp.json files is like leaving your keys in a fake rock labeled “keys” on your doorstep.
Local MCPs are a security nightmare.
There was a recent case where someone had a malicious vs code extension drain his crypto. That’s the same attack vector, but oauth tokens are at stake.
Most CISOs are intentionally turning a blind eye to MCP so they don’t get blamed for slowing AI efforts.
But putting oath tokens in config/mcp.json files is like leaving your keys in a fake rock labeled “keys” on your doorstep.
Local MCPs are a security nightmare.
There was a recent case where someone had a malicious vs code extension drain his crypto. That’s the same attack vector, but oauth tokens are at stake.