Hacker News Reader

Comment by eddythompson80 | Hacker News Reader

As it has been mentioned before, MCP isn't "vulnerable". It's just on the other side of your air lock. Think of your MCP as a different client application. The whole thing is just a client. The fact that you need to write a client for your client is.... something, but your MCP app is a client app. It's boundaries with your service should be understood as such.

Saying MCP is vulnerable is like saying "Web applications are vulnerable. Anyone can see the API calls you're making and modify them or trick your UI app to make a different call and hack your system". Obviously that's mostly nonsense, but not 100% wrong either. You see it a lot with very very inexperienced developers who think "just because my App is Android/iOS only I don't need to worry about authn/authz". There was just a story on here few weeks ago about some New Zealand startup that did that

View on HN

The MCP ecosystem right now actively encourages insecure behavior. Just installing a popular WhatsApp sever can give attackers access to your private data - they can text you with instructions for your assistant to forward private messages to another account using tricks to help make that action look legit so you'll approve it: https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/#m...

But you can replace MCP with any tech and you have the same valid sentence.

“Attackers are using (email attachments, SMSs, TeamViewer, crypto wallet, phishing websites, etc) to access your private data - they can […] you using tricks to make it seem legit”

The only difference is that AI/MCP is the current flavor of the month for this type of attacks. These attacks get much worse when the tech has the hype (like AI now or limewire 20 years ago or the internet 30 years ago) and the average user still doesn’t quite fully grasp what this tech is doing or how it’s working.

I somewhat agree, but I think an important distinction is that in this case, you are legitimately giving the MCP server your credentials - there are no tricks there.

This is distinct from various forms of phishing where they are tricking you to give access to sensitive information. Here, you are giving that access willingly to something that is then itself vulnerable to being tricked/tricking you.

I think the JavaScript world has given up on all of these secure behaviors a long time back. Just look at Next.js

It has caused a complete disaster to the entire software industry.

Would take decades to recover from that mistake that was JavaScript (and TypeScript)

> The fact that you need to write a client for your client is...

correct me if im wrong, but isnt that a proxy? why is everyone calling it a server

Yes! It's a proxy that might modify results on the way in or out, which proxies can do.

Could also be called a gateway, which feels a bit more accurate.

The same way API gateways perform additional services like rate-limiting and authentication and billing, an MCP gateway abstracts the services behind it and adds context such that an LLM can more easily interact with them.

More here (not my post, someone I know wrote this): https://hookdeck.com/blog/mcp-gateway

in this case, people are arguing it's a MITM attack, obscured by the MCP

Yeah it is a proxy. I feel that in general we always use the term proxy as short for transparent proxy, while "server" is a bit more general purpose.

If you squint hard enough you can call almost any server a proxy. An FTP server is a proxy for data on disk. Github.com is a proxy for a git repo.

But yeah, saying "MCP is a proxy to your application" might be more insightful than "MCP is a client to your application"

Reply on news.ycombinator.com