New protein therapy shows promise as antidote for carbon monoxide poisoning (medschool.umaryland.edu)

We kept seeing devs get pwned through MCP tools in ways that security scanners completely miss. So we built an open-source analyzer to catch these attacks. Our first OSS by Mighty team.

The problem: At Defcon, we saw MCP exploits with 100% success rate against Claude and Llama. Three attack patterns:

Hidden Unicode in "error messages" - Paste a colleague's error into Claude, your SSH keys get exfiltrated Trusted tool updates - That database tool you've used for months? Last week's update added credential theft Tool redefinition - Malicious tool redefines "deploy to prod" to run attacker's script

Traditional scanners (CodeQL, SonarQube) catch <15% of these. They're looking for SQLi, not prompt injections hidden in tool descriptions.

What we built: git clone https://github.com/NineSunsInc/mighty-security

python analyzers/comprehensive_mcp_analyzer.py /path/to/your/mcp/tool

Scans for prompt injection, credential exfil, suspicious updates, tool shadowing. Runtime wrapper adds <10ms overhead. Fully local, no telemetry.

Why this matters: 43% of MCP tools have command injection vulns. GitHub's own MCP server was exploitable. We found Fortune 500s running database-connected MCP tools that hadn't been audited since installation. We went from paranoid code review to "AI said it works" in 18 months. The magic is real, but so are the vulnerabilities.

Demo: https://www.loom.com/share/e830c56d39254a788776358c5b03fdc3

GitHub: https://github.com/NineSunsInc/mighty-security

Would love feedback - what MCP security issues have you seen?

Comments (8)

simonw · 14m ago

> Would love feedback - what MCP security issues have you seen?

For me the number one problem with MCP security is the lethal trifecta - the fact that it's so easy to combine MCPs from different vendors (or even from the same vectors) that provide exposure to potentially untrusted/malicious instructions in a way that can then trigger exfiltration of private data.

https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

https://simonwillison.net/2025/Aug/9/bay-area-ai/

I don't know how we can solve this with more technology - it seems to me to be baked into the very concept of how MCP works.

simonw · 20m ago

I found this file full of regular expressions: https://github.com/NineSunsInc/mighty-security/blob/28666b36...

And this with prompts: https://github.com/NineSunsInc/mighty-security/blob/89e4b319...

Are you running any other tests that I missed?

ripley12 · 28m ago

I work in this space and I was not able to understand how this project works in a couple minutes. The README feels LLM-generated. I think you're supposed to point this at your MCP server's code and not the server itself, is that right?

Munam · 1h ago

Helped to build this out a little bit. Was really cool to get to play with Cerberus for the first time as well.

I'm really interested in learning more about how devs integrate MCP security into their routine code evals.

I think there's a big opportunity as a space to get tools like this into CI/CD pipelines and workflows.

Happy to answer any questions and happy to hear any feedback!

Thanks for checking it out :)

jodoking · 1h ago

Appreciate the interest and the first comments man. We like how fast Cerebras is and its importance to making the scanning fast! Yeah we have thought about this being part of dev workflow via Github Actions and locally for the dev environment too. Love to hear what you are building!

jelambs · 1h ago

this is super interesting! MCP is really exciting in terms of what it can unlock for agent use cases, but still the wild west in terms of security. I was on a panel discussion yesterday where this topic came up, basically how do you trust the use of AI tools when so much is still unknown. I think the the idea of using something open source and tool agnostic is appealing, the landscape is evolving so fast that horizontal solutions like this feel valuable. Although I wish clients, anthropic, cursor, etc would build more protections in too so that we didn't have to spend so much time thinking about this. but they've barely implemented remote mcp support so I think we have a ways to go.

IMAYousaf · 1h ago

This is definitely valuable. I started paying attention to MCP security vulnerabilities largely because of Defcon. I believe that they largely focused on Agentic Security as a theme this time around.

It's a bit mind blowing how we've simply accepted non-technical people within orgs in particular executing code to "automate their tasks" without the same level of rigor that normal code reviews go through. Definitely think that this is a cultural issue that we must fix.

And these MCP vulnerabilities in particular seem much scarier because almost all MCP tools require an insane amount of permissions.

jodoking · 1h ago

I know right? I mean the timing is great. I love MCP but cant stand how unsafe it is. I think there are greatness ahead if we are able to fix this security issue. This was made around the idea to be as seamless as possible, as we built a dashboard, drop in a GH project MCP server link, and have a local DB to show what you ran. We have more great things ahead. But give it a try and let us know what you think!

Gemma 3 270M: Compact model for hyper-efficient AI (developers.googleblog.com)

Streaming services are driving viewers back to piracy (theguardian.com)

Steve Wozniak: Life to me was never about accomplishment, but about happiness (yro.slashdot.org)

Org-social is a decentralized social network that runs on Org Mode (github.com)

We Rewrote the Ghostty GTK Application (mitchellh.com)

I made a real-time C/C++/Rust build visualizer (danielchasehooper.com)

OneSignal (YC S11) Is Hiring Engineers (onesignal.com)

New protein therapy shows promise as antidote for carbon monoxide poisoning (medschool.umaryland.edu)

Show HN: OWhisper – Ollama for realtime speech-to-text (docs.hyprnote.com)

What's the strongest AI model you can train on a laptop in five minutes? (seangoedecke.com)

Architecting large software projects [video] (youtube.com)

Airbrush art of the 80s was Chrome-tastic (2015) (coolandcollected.com)

Blood oxygen monitoring returning to Apple Watch in the US (apple.com)

All Souls exam questions and the limits of machine reasoning (resobscura.substack.com)

Show HN: I built a free alternative to Adobe Acrobat PDF viewer (github.com)

Launch HN: Cyberdesk (YC S25) – Automate Windows legacy desktop apps

1976 Soviet edition of 'The Hobbit' (2015) (mashable.com)

Show HN: MCP Security Suite (github.com)

How to rig elections [video] (media.ccc.de)

Reverse Proxy Deep Dive: Why Load Balancing at Scale Is Hard (startwithawhy.com)

"Privacy preserving age verification" is bullshit (pluralistic.net)

Bluesky: Updated Terms and Policies (bsky.social)

Homekit-steam-user-switcher: A way to remotely switch Steam users using HomeKit (github.com)

What does Palantir actually do? (wired.com)

Nyxt: The Emacs-like web browser (lwn.net)

500 days of math (gmays.com)

Funding Open Source like public infrastructure (dri.es)

Show HN: Modelence – Supabase for MongoDB (github.com)

Why and how to write things on the Internet (2022) (benkuhn.net)

DINOv3 (github.com)

iPhone DevOps (2023) (clearsky.dev)

Arch shares its wiki strategy with Debian (lwn.net)

NSF and Nvidia award Ai2 $152M to support building an open AI ecosystem (allenai.org)

Show HN: Zig-DbC – A design by contract library for Zig

Big Tech's A.I. Data Centers Are Driving Up Electricity Bills for Everyone (nytimes.com)

SIMD Binary Heap Operations (0x80.pl)

Kodak has no plans to cease, go out of business, or file for bankruptcy (kodak.com)

Zenobia Pay – A mission to build an alternative to high-fee card networks (zenobiapay.com)

DINOV3: Self-supervised learning for vision at unprecedented scale (ai.meta.com)

Fundamental Flaw of Hustle Culture (brodzinski.com)

Passion over Profits (dillonshook.com)

Jujutsu and Radicle (radicle.xyz)

Show HN: Yet another memory system for LLMs (github.com)

A new poverty line shifted the World Bank's poverty data (ourworldindata.org)

Linux address space isolation revived after lowering performance hit (phoronix.com)

Is chain-of-thought AI reasoning a mirage? (seangoedecke.com)

What are the real numbers, really? (2024) (infinitelymore.xyz)

KosmicKrisp a Vulkan on Metal Mesa 3D Graphics Driver (lunarg.com)

Fun with Finite State Transducers (blog.yossarian.net)

What medieval people got right about learning (2019) (scotthyoung.com)

Show HN: MCP Security Suite

Comments (8)