#security
Everything tagged #security across the site
15 articles
Those are the other app's keys
Twenty minutes recovering secrets that never existed, and the one sentence from a human that ended it
How to use remote MCP servers with the OpenAI Responses API
An API request routing a model's tool call through an approval gate to a remote MCP server
The coverage audit before you delete the safety net
31 config keys, two audits, and why the first one was wrong in both directions
How to publish an MCP server to the official MCP Registry
The official MCP Registry stores standardized server metadata rather than package code. Publishers verify a namespace, describe installation or remote access, and submit immutable versions.
Rotating a leaked credential, in the right order
Everyone looks at the Dockerfile. The file that actually leaked the key was the project file.
MCP authentication explained: OAuth, scopes, and safe token handling
Remote MCP authorization uses established OAuth standards, but secure integration still requires issuer validation, least-privilege scopes, protected token handling, and server-side enforcement.
Byte-identical or bust
"Copy it over and switch the reference" is two steps, and the outage lives in the one nobody checks
MCP stdio vs. Streamable HTTP: which transport should you use?
stdio fits local processes and prototypes. Streamable HTTP fits hosted services and shared integrations. The right choice follows where the capability runs and who must reach it.
Never let the AI print a secret
The most important rule wasn't about what I could change. It was about what I was allowed to display.
MCP tools vs. resources vs. prompts: when to use each
Tools perform operations, resources expose readable context, and prompts provide reusable templates. Choosing the correct primitive makes an MCP server easier to understand and govern.
How to test an MCP server with MCP Inspector
Use MCP Inspector to connect to local or remote servers, inspect capabilities, call tools, read resources, test prompts, and diagnose failures before release.
How to build an MCP server in TypeScript: step-by-step
Build an MCP server in TypeScript with focused tools, validated schemas, local and remote transports, Inspector tests, and production security controls.
How to vet AI agent skills before installing them
Treat an AI agent skill as both an instruction package and a software dependency: inspect what it says, what it runs, what it can access, and how it updates.
Point your agent at the catalogue: the LLM Mart MCP server and API
The whole public catalogue is an MCP server and a REST API, so your agent can search skills, tools and slash-commands as native tools. Setup is one config block. Plus a private vault that carries your own prompts between machines.
Prompt injection is not an XSS problem
Sanitizing output protects your page. It does nothing for an agent that reads a poisoned README and then runs a command. A practical model of the threat, and what actually helps.