CVE-2025-54136

A new harness that actually starts and tests Model Context Protocol (MCP) servers found that only 65 of 182 servers (36%) connected and listed their tools, while 83 (46%) failed to start unattended an…

A developer warns that MCP (Model Context Protocol) tools can be silently mutated after user approval, enabling attacks like tool poisoning and prompt injection via tool output. The vulnerability, tra…

A developer built ghostprobe, a red-team scanner for MCP servers that detects tool poisoning and the 'lethal trifecta' of data access, sink, and untrusted input. When pointed at real servers, it found…