Vibe Coding
Pattern: the MCP security story has moved from individual servers to the SDKs everyone builds on
The last three days of advisories hit mcp-searxng, MCPVault and Contentful's server, all individual implementations. Today's four land on rmcp, the official Rust SDK, and one on Kong's gateway. The failure classes are identical to the per-server ones (unvalidated URLs, redirect header leakage, missing origin checks, resource exhaustion), but a single SDK bug reaches every server built on it rather than one deployment. Auditing your own MCP server's code is no longer sufficient; pin and track the SDK version too, and note that rmcp's fixes landed across three different releases (1.4.0, 2.0.0, 2.1.0), so one upgrade does not clear all four.
↳ Follow the thread