Hacker News: mavzer

New comment by mavzer in "The State of MCP Security [pdf]"

mavzer — Mon, 13 Jul 2026 08:51:48 +0000

100%!! All AI tooling (MCPs, skills, models etc) has to go through the same scrutiny applied to any other web service. But as always, security is an afterthought that comes back to bite.

New comment by mavzer in "The State of MCP Security [pdf]"

mavzer — Sun, 12 Jul 2026 23:15:17 +0000

Nice. Basically, I see 3 ways the MCP ecosystem converging

- Centralized, well trusted sources for MCP servers - Technical people like you creating their own, private MCPs for specific use cases - An MCP governance layer that brings a bit of sense into this new world

Otherwise, it’s a security time bomb. We already see MCP specific attacks out in the wild.

New comment by mavzer in "Ask HN: What Are You Working On? (July 2026)"

mavzer — Sun, 12 Jul 2026 22:39:10 +0000

https://index.canopii.dev

Part of my job is to approve / reject MCP servers based on how secure they are and whether they are suitable for use in an enterprise environment. I was tired of my team being called the bottleneck to AI adoption, so I set out to automate the whole process.

I periodically collect the MCP servers and every new version from the Official MCP registry and assign them a score based on 29 distinct criteria like runtime guardrails (e.g. destructive tools, over broad permissions, rug pulls), SAST scans and transport & trust model.

As a result of this exercise, I found that 1 in every 10 MCP servers is pretty much unusable (score 40/100 or below). 18% of the popular MCP servers with 1000+ GitHub stars contain one or more security issues. 184 servers to date have changed their tool definitions after publication, which may indicate a "rug pull" attack.

I built this for security minded people who also want to be at the forefront of AI adoption and for security teams who are tired to be called the bottleneck.

Browsing the index is completely free, you only have to request an API key if you want automated, programmatic lookups for any workflow.

Feedback is always welcome!

The State of MCP Security [pdf]

mavzer — Sun, 12 Jul 2026 20:49:46 +0000

Article URL: https://www.canopii.dev/State%20of%20MCP%20Security%202026.pdf

Comments URL: https://news.ycombinator.com/item?id=48884647

Points: 38

# Comments: 4

Show HN: A Trust Index for MCP Servers

mavzer — Sat, 11 Jul 2026 18:57:14 +0000

As a security professional whose employer has given Claude and various other AI tooling to everyone at the company, I kept finding myself as the bottleneck because my team had to review sometimes 4-5 repositories of MCP servers a day just to give a verdict whether it's safe to use in an enterprise environment.

So to make my life easier, I built an easy to read index that pulls all the MCP servers from the Official MCP Registry (https://registry.modelcontextprotocol.io/) periodically and scores them automatically based on several criteria like runtime guardrails, SAST scans, transport model etc.

I also recently made it available via an API so that others can integrate it into their workflow.

Feedback is always welcome!!!

PS: Index came first, it's completely free (you just have to request the API access, no payment required) and it works great (12k MCP servers scanned&scored and still counting!) for my use case so I started thinking whether I can govern the AI adoption a bit more in a friendly way without being the bottleneck. That's when the Canopii platform came to be. This is not meant as an ad for that.

Comments URL: https://news.ycombinator.com/item?id=48874692

Points: 1

# Comments: 0