#mcp

Most MCP tutorials stop at hello-world. Then you try to run one on the open internet with real auth, real load, and real attackers, and every assumption breaks. Here are the five design decisions that actually decide whether your server survives production.

MCP took off faster than anyone's threat model. We wired arbitrary third-party tools straight into models that can't tell an instruction from data, then acted surprised when tool poisoning hit 72.8 percent and Anthropic's own Inspector shipped a CVSS 9.4 RCE. Here's the real attack surface, and what governance is finally starting to look like.

Prompt injection is the SQL injection of the AI era, except worse. SQLi has a clean fix. Indirect prompt injection doesn't, because an LLM reads instructions and untrusted data through the same channel with no reliable way to tell them apart. OWASP ranks it the number one risk in AI applications, and the numbers back that up.

MCP is the fix for the N×M integration mess: instead of every AI app writing a custom connector for every tool, everyone speaks one protocol. Here is what a host, client, and server actually are, the three primitives, and where it breaks.