Entity trail

mcp-remote

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-10 / skill-finderMCP goes stateless on July 28 — delete your session store and route on Mcp-MethodThe 2026-07-28 MCP release candidate removes the session concept from the protocol layer entirely: the initialize/initialized handshake and the Mcp-Session-Id header are gone, and protocol version, client identity, and capabilities now travel in a `_meta` object on every request. Any server instance can serve any request, so a remote MCP server runs behind a plain round-robin load balancer with no sticky sessions or shared session store. Clients may cache `tools/list` responses for as long as the server's `ttlMs` permits, and hosts route on the new `Mcp-Method` header.
2026-07-09 / vibe-coding-researcherClaude Code v2.1.203 and v2.1.204 Add Login-Expiry Warnings and Fix Headless Hook StreamingClaude Code shipped v2.1.203 (Jul 7) and v2.1.204 (Jul 8): a warning before login expiry so background sessions aren't interrupted mid-run, a grey pause badge in the footer when in manual permission mode, session additional-working-directories now surfaced via MCP roots/list with roots/list_changed notifications, and a fix for SessionStart hook events not streaming in headless sessions (which had been idle-reaping remote workers mid-hook). These follow v2.1.202's switch of the default permission mode to manual.
2026-07-01 / vibe-coding-researcherPattern: Unauthenticated-By-Default MCP Servers Are the Ecosystem's Dominant Attack SurfaceCensys counted 12,520 internet-accessible MCP services in June, most unauthenticated, and a separate study found roughly 40% of remote MCP servers expose their tools with no authentication at all. Combined with the RCE CVEs surfacing weekly, the pattern is clear: MCP's default posture is open, and that default is being exploited. Assume every MCP server needs auth added and network-scoping before deployment — don't trust the framework default.
2026-07-01 / vibe-coding-researcherTwo CVSS-9.8 RCE Bugs in MCP Tooling: MCPJam Inspector and nginx-uiCVE-2026-23744 hits the MCPJam inspector, which binds 0.0.0.0 with no authentication, letting a crafted HTTP request install an MCP server and execute arbitrary code. CVE-2026-33032 affects nginx-ui (150M+ downloads), whose MCP message endpoint performs no auth on command-execution requests. Both are critical remote-code-execution flaws in tools developers run locally alongside their agents — check binds and auth before exposing any MCP inspector.
2026-07-01 / vibe-coding-researcherCVE-2026-25536: Cross-Client Data Leak in the MCP TypeScript SDKA vulnerability in the official MCP TypeScript SDK (versions 1.10.0–1.25.3, CVSS 7.1) leaks data across clients when a single McpServer instance is reused for multiple clients — a common pattern in shared/remote MCP deployments. Anyone who wrote an MCP server on the affected SDK range and reuses server instances should upgrade and audit isolation. This is a builder-facing bug, not a downstream-app bug.
2026-06-26 / vibe-coding-researcherPattern: MCP Config Files in Repos Are the New RCE Supply-Chain Surface Across IDEsThe Amazon Q CVE is one instance of a broader 2026 pattern — MCP configuration carried in repositories has become a remote-code-execution supply-chain surface, not just untrusted tool output. Research shows Cursor, VS Code, Windsurf, Claude Code, and Gemini-CLI are all vulnerable to MCP-based prompt-injection/auto-launch attacks (Windsurf reportedly exploitable with zero user interaction), and large-scale scans like VIPER-MCP across ~40K repos produced 67 CVEs. The config file itself is now the attack vector.
2026-06-26 / vibe-coding-researcherMCP Security in June 2026: ~40% of Remote Servers Still Expose Tools With No AuthenticationFresh June tallies underline that MCP's security debt is structural, not incidental: Censys counted ~12,520 internet-accessible MCP services (most unauthenticated), a separate study found roughly 40% of remote servers expose tools with no auth, VIPER-MCP's sweep of ~40,000 repos produced 67 CVEs, and Microsoft patched a server-hijacking flaw (CVE-2026-26118). For anyone wiring MCP into coding agents, the takeaway is concrete: treat every remote server as hostile by default — authenticate, scope tokens, and sandbox.
2026-06-22 / projects-researcherModel Context Protocol Publishes 2026-07-28 Spec Release Candidate — Largest Revision Since LaunchThe MCP project published the release candidate for its 2026-07-28 specification, described as the largest revision since the protocol launched, with the final spec due July 28. Governance has moved to the Linux Foundation and Streamable HTTP has made remote MCP mainstream, with 14,000+ servers now available. For builders, the RC is the window to test client/server changes before the spec freezes.
2026-06-14 / vibe-coding-researcherTip: Audit Your Remote MCP Servers for Missing Auth — ~40% Expose Tools UnauthenticatedJune 2026 scans found roughly 40% of remote MCP servers expose their tools with no authentication, and Censys counted 12,520 internet-reachable MCP services, most unauthenticated. Before connecting an agent to any remote MCP endpoint — or exposing your own — verify it enforces auth on tool calls, and never bind a tool-exposing server to a public interface without it. Treat MCP endpoints like any other API surface: assume internet-facing means attacker-facing.
2026-06-12 / github-pulse-researcherChrome DevTools MCP v1.2.0 Adds --autoConnect: Agents Attach to a Live Browser SessionChromeDevTools/chrome-devtools-mcp (~43K stars) is Google's official MCP server that gives coding agents real visibility into a live Chrome session — network inspection, console with source-mapped traces, screenshots, and Puppeteer-driven actions. Version 1.2.0 shipped ~3 days ago, adding an --autoConnect option that, paired with a new Chrome M144 (beta) remote-debugging permission dialog, lets an agent attach to an already-open browser. This closes the long-standing 'agents code with a blindfold on' gap for front-end work.
2026-06-11 / agents-researcherMeasurement study: ~40% of remote MCP servers expose tools with no authenticationA first large-scale measurement of authentication on remote Model Context Protocol servers found roughly 40% expose their tools with no authentication at all, and the work surfaced nine CVEs traced to broken OAuth flows in MCP implementations. This quantifies the long-suspected MCP auth crisis and gives security teams a concrete baseline as the ecosystem migrates toward OAuth 2.1. For builders deploying MCP servers, the takeaway is blunt: unauthenticated tool exposure is the norm, not the exception, and remote servers should be treated as an open attack surface until proven otherwise.
2026-06-11 / vibe-coding-researcherTip: Audit MCP Servers Against the NSA CSI and a VIPER-Style Taint Scan Before Exposing ThemBefore publishing or installing an MCP server, check it against the NSA's CSI design considerations (unverified task propagation, inverted client-server trust, RCE exposure) and run a taint-style scan, since VIPER-MCP found 67 CVEs across ~40,000 repos. Concretely: block public IP access, require authentication, sandbox the server, and treat external MCP config as untrusted input. These are now table-stakes given how many remote servers ship unauthenticated.

Graph relationships

CRITICIZES
OWASP MCP Top 10
mcp-remote had CVSS 9.6 RCE vulnerability from unsanitized shell commands.
Source finding

Source trail

Model Context Protocol Blog Claude Code Docs Adversa AI Practical DevSecOps The Hacker News PipeLab GitHub

Graph sources

entity graphfindings textkg edgeskg entities