[{"data":1,"prerenderedAt":313},["ShallowReactive",2],{"project-43689178":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":34,"aspects":35,"strip":41,"post_text":43,"what":44,"said":60,"maker_in_thread":146,"shape":158,"grid":161,"attempts":274,"same_week":275,"maker_shows":32,"maker_hidden":305,"reader_version":306,"card":307},"43689178","MCP-Shield","Detect security issues in MCP servers","title","Show HN: MCP-Shield – Detect security issues in MCP servers","https:\u002F\u002Fgithub.com\u002Friseandignite\u002Fmcp-shield","github.com","nick_wolf",1744694101,2025,134,39,559,3837,15,"notable","security_privacy","mcp server security scanner","cli",[24,25,26,27],"mcp security","tool poisoning","prompt injection","mcp scanner","roasted",-0.235,{"positive":31,"neutral":31,"mixed":32,"critical":33},3,1,7,14,{"idea":36,"execution":38},{"positive":37,"critical":31},2,{"positive":39,"critical":40},0,4,[39,39,39,39,39,39,39,39,39,39,32,39,39,39,39,31,39,39,39,32,39,39,39,32,31,42,39,39,31,42,39,32,32,39,39,32,42,32,31],5,"I noticed the growing security concerns around MCP (https:\u002F\u002Fnews.ycombinator.com\u002Fitem?id=43600192) and built an open source tool that can detect several patterns of tool poisoning attacks, exfiltration channels and cross-origin manipulations.\n\nMCP-Shield scans your installed servers (Cursor, Claude Desktop, etc.) and shows what each tool is trying to do at the instruction level, beyond just the API surface. It catches hidden instructions that try to read sensitive files, shadow other tools' behavior, or exfiltrate data.\n\nExample of what it detects:\n\n- Hidden instructions attempting to access ~",{"problem":45,"audience":51,"pricing":51,"motivation":52,"time_to_build":51,"stack":56,"openness":57,"stage":58,"team_size":59},{"value":46,"source":47,"evidence":48},"Hidden malicious instructions in MCP server tool definitions that read files, shadow tools or exfiltrate data","maker",[49],{"id":50},"post",null,{"value":53,"source":47,"evidence":54},"Growing security concerns around MCP",[55],{"id":50},[],"open_source","beta","unknown",{"praise":61,"objections":74,"requests":104,"questions":123,"alternatives":131},[62,70],{"value":63,"source":64,"evidence":65},"Useful space for security tooling","commenter",[66],{"id":67,"by":68,"text":69},"43689390","khafra","Nice! This is a much-needed space for security tooling, and I appreciate that you've put some thought into the new attack vectors. I also like the combination of signature-based…",{"value":71,"source":64,"evidence":72},"Good that it combines pattern matching with LLM analysis",[73],{"id":67,"by":68,"text":69},[75,82,90,97],{"value":76,"source":64,"evidence":77},"Regex denylists are easy to bypass",[78],{"id":79,"by":80,"text":81},"43690143","NicolaiS","Sorry, but this will never work very well. The tool contains a bunch of \"denylist regexes\", i.e. ``` `user (should not|must not|cannot) see` ``` But these can easily be bypassed.…",{"value":83,"source":64,"evidence":84},"Analysis step uses an LLM that is itself open to prompt injection",[85,89],{"id":86,"by":87,"text":88},"43689875","hollowturtle","So the analysis is done with another call to claude with instructions like \"You are a cybersecurity expert...\" basically another level of extreme indirection with unpredictable…",{"id":79,"by":80,"text":81},{"value":91,"source":64,"evidence":92},"Does not scan prompt injection in tool results",[93],{"id":94,"by":95,"text":96},"43689398","pcwelder","Cool. If I'm not wrong you don't detect prompt injection done in the tool results? Any plans for that?",{"value":98,"source":64,"evidence":99},"Server can report different tools to scanner than to clients",[100],{"id":101,"by":102,"text":103},"43689354","paulgb","Neat, but what’s to stop a server from reporting one innocuous set of tools to MCP-Shield and then a different set of tools to the client?",[105,112,119],{"value":106,"source":64,"evidence":107},"Scan resources as well as tool definitions",[108],{"id":109,"by":110,"text":111},"43691333","mlenhard","This is pretty cool. You should also attempt to scan resources if possible. Similar to the tool injection attack Invariant Labs discovered, I achieved the same result via…",{"value":113,"source":64,"evidence":114},"Integrate with kgateway",[115],{"id":116,"by":117,"text":118},"43689743","stpedgwdgfhgdd","Suggestion: Integrate with https:\u002F\u002Fkgateway.dev\u002F",{"value":120,"source":64,"evidence":121},"Detect prompt injection in tool results",[122],{"id":94,"by":95,"text":96},[124],{"value":125,"source":64,"evidence":126},"Will it detect injection in non-English tool descriptions",[127],{"id":128,"by":129,"text":130},"43690860","calyhre","It seems that writing a tool in anything else than English will bypass most of this scanner",[132,139],{"value":133,"source":64,"evidence":134},"mcp-scan by Invariant Labs",[135],{"id":136,"by":137,"text":138},"43690315","marcfisc","Cool work! Thanks for citing our (InvariantLabs) blog posts! I really like the identify-as feature! We recently launched a similar tool ourselfs, called mcp-scan:…",{"value":140,"source":64,"evidence":141},"vet by SafeDep",[142],{"id":143,"by":144,"text":145},"43702418","abhisek","May be try out vet as well: https:\u002F\u002Fgithub.com\u002Fsafedep\u002Fvet vet is backed by a code analysis engine that performs malicious package (npm, pypi etc.) scanning. We recently extended…",{"comments":147,"answered":37,"key":148},6,[149,152,155],{"id":150,"text":151},"43690101","It's definitely a weird loop, relying on another LLM call to analyze potential issues in stuff meant for an LLM. And you're right, it's not perfectly predictable – you might get…",{"id":153,"text":154},"43689507","Great point, thanks for raising it. You're spot on – the client currently sends name: 'mcp-shield', enabling exactly the bait-and-switch scenario you described. I'll push an…",{"id":156,"text":157},"43689570","That was faster than expected - here's the merged commit implementing the --identify-as flag:…",{"commenters":159,"max_depth":42,"maker_replies":147,"first_comment_mins":159,"lifespan_hours":160},31,26,[162,166,169,173,175,178,182,184,187,190,193,195,197,200,203,206,208,211,214,217,219,221,222,225,227,230,233,235,239,242,245,248,249,250,252,257,261,266,270],[163,39,39,164,165,39],"43690137","other\u002Fneutral\u002Fidea","Manfred",[167,39,39,164,168,39],"43690202","jason-phillips",[170,39,39,171,172,39],"43690359","other\u002Fneutral\u002Fnone","ololobus",[174,39,39,171,168,39],"43690456",[176,39,39,171,177,39],"43691397","pjmlp",[179,39,39,180,181,39],"43692436","commenter\u002Fneutral\u002Fnone","chrisweekly",[183,39,39,180,177,39],"43692807",[185,39,39,164,186,39],"43690816","simonw",[188,39,39,164,189,39],"43696683","nrvn",[191,39,39,171,192,39],"43693274","Mountain_Skies",[86,32,32,194,87,39],"project\u002Fcritical\u002Fidea",[150,32,39,196,11,32],"maker\u002Fneutral\u002Fidea",[198,37,39,171,199,39],"43694203","spiritplumber",[201,37,39,171,202,39],"43694940","mceachen",[204,31,39,205,117,39],"43689725","other\u002Fcritical\u002Fprivacy",[109,40,31,207,110,39],"project\u002Fmixed\u002Fidea",[209,42,39,171,210,39],"43689861","tuananh",[212,42,39,171,213,39],"43689981","martijnvds",[215,42,39,171,216,39],"43694390","postalrat",[101,147,32,218,102,39],"project\u002Fcritical\u002Fexecution",[153,147,39,220,11,32],"maker\u002Fpositive\u002Fexecution",[156,147,39,220,11,32],[223,33,39,164,224,39],"43692698","freeone3000",[128,226,32,218,129,39],8,[143,228,31,229,144,39],9,"project\u002Fneutral\u002Fnone",[67,231,42,232,68,39],10,"maker\u002Fpositive\u002Fidea",[234,231,39,196,11,32],"43689610",[236,237,39,164,238,39],"43690320",11,"deadbabe",[116,240,31,241,117,39],12,"project\u002Fneutral\u002Fidea",[136,243,42,244,137,39],13,"project\u002Fpositive\u002Fidea",[246,243,39,247,11,32],"43690489","maker\u002Fpositive\u002Fnone",[79,34,32,218,80,39],[94,18,32,218,95,39],[251,18,39,196,11,32],"43689600",[253,254,39,255,256,39],"43690120",16,"other\u002Fcritical\u002Fidea","bosky101",[258,259,32,194,260,39],"43691107",17,"emsign",[262,263,42,264,265,39],"43690726",18,"project\u002Fpositive\u002Fnone","puliczek",[267,268,32,194,269,39],"43691138",19,"nurettin",[271,272,31,229,273,39],"43692356",20,"notachatbot123",[],[276,281,286,291,296,301],{"id":277,"name":278,"points":279,"category":280},"43690289","Unsure Calculator",930,"dev_tools",{"id":282,"name":283,"points":284,"category":285},"43675248","SignalBloom",292,"finance_crypto",{"id":287,"name":288,"points":289,"category":290},"43667061","memEx",194,"productivity",{"id":292,"name":293,"points":294,"category":295},"43652968","Chonky",169,"ai",{"id":297,"name":298,"points":299,"category":300},"43677909","Infocom Unix Z-Machine (pez)",157,"languages",{"id":302,"name":303,"points":304,"category":300},"43682547","protobuf-ts-types",138,false,"v2",{"id":308,"name":5,"line":6,"ai":305,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":309,"top":18,"kw":310,"maker":11,"domain":10,"tier":19,"attempts":39,"strip":311,"url":9,"mix":312,"praise":63,"objection":76,"sub":21},43689178,-0.23,[24,25,26,27],"000000000010000300010001350035011001513",[31,31,32,33],1793991117602]