The official MCP Python SDK (1.9.1–1.29.1 and 2.0.0–2.1.1) could send client secrets, auth codes, and PKCE keys to an attacker-controlled token endpoint when connecting over HTTP OAuth. Fix is 1.30.0 / 2.2.0; ClientCredentials and PrivateKeyJWT users must also set issuer=, clear stored registrations, and rotate secrets if they connected to untrusted servers.
Announced Nov 14, the server lets agents audit policies, detect drift and manage exemptions across a Google Cloud org. Gemini can also draft and dry run custom constraints from plain English…
SitecoreAI's Developer MCP server is in beta with 13 tools for component development, content modeling and content creation. It connects to Cursor, Claude Code, Codex, VS Code and OpenCode via MCP OAuth…
Announced Nov 13, the MIT licensed proxy sits between an agent and its MCP tools and allows, blocks, modifies or pauses each call for approval. Every decision goes into a hash chained audit log, and it installs from PyPI as vaikora guard mcp…
Announced Nov 13, the server lets AI assistants query security alerts, pull Cyber AI Analyst findings, and run triage actions across licensed Darktrace products. A read only mode hides tools that change data…
Announced Nov 13, the hosted server at mcp.resend.com now lets agents handle email tasks plus admin actions like inviting teammates and managing billing. It signs in with OAuth or an API key, and a local npm version is also available…
Spotted something we missed? Start a thread.