Hacker News Reader

Comment by belschak | Hacker News Reader

The application-level visibility point matches my experience. I removed an MCP server a while back because its tool descriptions quietly told the agent to prefer it as the primary search tool over the built-in one. Not a vulnerability, no leaked secrets, just the vendor steering agent behavior in a way you only notice if you read the raw tool definitions. Does mcp-xray flag that kind of prompt-level steering in tool descriptions, or is it focused on classic vulns?

View on HN

That's a great example. It's exactly the kind of behavior we think deserves more attention. It's not a traditional vulnerability but it can significantly influence an agent's decision-making.

Today, mcp-xray (https://github.com/traceforce/mcp-xray) can be used to dynamically (not just statically) test against your MCPs. It can detect security vulnerabilities such as code execution, SSRF, path traversal, authorization bypass, input injection, DoS etc. You can find us at demo labs during DEF CON this year. That said, we think behavioral influence is an important problem and it's an area we're interested in exploring next.

I work at Speakeasy where we do a similar thing with the AI control plane (https://www.speakeasy.com/product/ai-control-plane), and we just rolled out on-device agents for the same reason.

I think the point a few people are making is right that its not sufficient to be the best at one layer like the device endpoint. AI governance needs to be coordinated over a number of surfaces. We started with an MCP gateway and drilled down to on-device agents. I imagine you might end up doing the same the other way around.

Yes you are spot on! On-device agents can only do so much. We integrate with popular gateways such as Kong to bring MCP controls. We primarily manage the registries for MCPs with vulnerabilities that gateway companies don't do today.

oh and to add on this, MCP gateways work mostly with remote MCPs only. For the stdio ones, we still need local agents to take care of the controls.

Wrote a bit more about our remote MCP approach here

https://x.com/sagar_batchu/status/2077800956817743927?s=46&t...

Reply on news.ycombinator.com