mighty-security

Don't Simply Trust MCP Server Code, Validate and Scan

Explore on GitHub Read Hacker News discussions

2Distinct people

2Mentions

0Explicit recommenders

98GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

Don't Simply Trust MCP Server Code, Validate and Scan

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by hour2 dated mentions

Observed mentions: 2025-08-14 20:01:33 UTC to 2025-08-14 21:22:44 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
Aug 14, 20:00	2025-08-14 20:00:00 UTC	2025-08-14 21:00:00 UTC	1	1	0
Aug 14, 21:00	2025-08-14 21:00:00 UTC	2025-08-14 22:00:00 UTC	1	0	1

What Hacker News says

2 sources

simonw·Aug 14, 2025

I found this file full of regular expressions: https://github.com/NineSunsInc/mighty-security/blob/28666b36... And this with prompts: https://github.com/NineSunsInc/mighty-security/blob/89e4b319... Are you running any other tests that I missed?

In Show HN: MCP Security Suite

jodoking·Aug 14, 2025Submission

Show HN: MCP Security Suite

Hi HN! We kept seeing devs get pwned through MCP tools in ways that security scanners completely miss. So we built an open-source analyzer to catch these attacks. Our first OSS by Mighty team. The problem: At Defcon, we saw MCP exploits with 100% success rate against Claude and Llama. Three attack patterns: Hidden Unicode in "error messages" - Paste a colleague's error into Claude, your SSH keys get exfiltrated Trusted tool updates - That database tool you've used for months? Last week's update added credential theft Tool redefinition - Malicious tool redefines "deploy to prod" to run attacker's script Traditional scanners (CodeQL, SonarQube) catch <15% of these. They're looking for SQLi, not prompt injections hidden in tool descriptions. What we built: git clone https://github.com/NineSunsInc/mighty-security python analyzers/comprehensiv

Read the rest

e_mcp_analyzer.py /path/to/your/mcp/tool Scans for prompt injection, credential exfil, suspicious updates, tool shadowing. Runtime wrapper adds <10ms overhead. Fully local, no telemetry. Why this matters: 43% of MCP tools have command injection vulns. GitHub's own MCP server was exploitable. We found Fortune 500s running database-connected MCP tools that hadn't been audited since installation. We went from paranoid code review to "AI said it works" in 18 months. The magic is real, but so are the vulnerabilities. Demo: https://www.loom.com/share/e830c56d39254a788776358c5b03fdc3 GitHub: https://github.com/NineSunsInc/mighty-security Would love feedback - what MCP security issues have you seen?

36 points · Open discussion