Tag: mcp
All the articles with the tag "mcp".
- Updated:
Your Own Machine Is the Attack Surface: Leftover Credentials, Permission Flags, Untrusted Input
Everyone talks about AI security as whether the model will say the wrong thing. What actually bites you is the plaintext keys left on your disk, the permission flag you waved through, and the untrusted input you fed it.
- Updated:
你的電腦才是攻擊面：殘留憑證、權限旗標、不可信輸入
大家談 AI 資安都在談模型會不會說錯話，但真正會咬你的是本機殘留的明文金鑰、隨手開的權限旗標，還有你讓模型讀進來的不可信輸入。
-
Your AI Tools Are Now the Attack Vector: npm and Python Supply-Chain Backdoors, a $1000 Stolen-Key Bill, and a Scan-Before-You-Install SOP
Attackers are planting instructions in Claude Code, Cursor, and Gemini CLI configs so your own assistant runs the exfiltration script. Two supply-chain waves, one $1000 stolen-key bill, and the five minutes to spend before installing anything.
-
你的 AI 工具已經是攻擊媒介：npm/Python 供應鏈後門、外洩金鑰盜刷 1000 美元，與裝 MCP 前的掃描 SOP
攻擊者已經在 Claude Code、Cursor、Gemini CLI 的設定檔裡植入指令，讓你的 AI 助手幫他們跑竊取腳本。這篇串起兩波供應鏈攻擊、一次一千美元的盜刷，以及安裝前該做的那五分鐘。
-
Better Context Beats a Stronger Model — repowise's Five-Layer Architecture
I came across repowise, a tool that inserts a layer of context between your codebase and the model. It is a good excuse to talk about a bigger idea: when a model breaks things, the first instinct is to reach for a stronger model, but the real cause is usually too little context.
-
給 LLM 更好的 context，勝過換更強的模型——repowise 的五層架構
看到 repowise 這個在 codebase 與模型之間插一層 context 的工具，想聊一個更大的觀念：模型改壞東西時，第一反應常常是換更強的模型，但真正的根因往往是 context 不夠。
-
Have Claude scan an MCP before you install it—it found 7 vulnerabilities and still said it's safe to install
This week AgentCrew Academy shipped a video about why you should run /security-scan before installing any MCP / npm / pip package. Tested a third-party MCP, Claude flagged 7 findings, then said "install is fine." This is the written companion to the video.
-
裝 MCP 之前先讓 Claude 幫你掃——找到 7 個漏洞，但說這個可以裝
講座當週我拍了一支影片，講「裝任何 MCP / npm / pip / clone 之前先跑 /security-scan」這件事。實測了一個三方 MCP，Claude 掃出 7 個漏洞，但綜合評估後說「可以裝」。這篇是影片的補充文字版。
-
Two MCP servers for Taiwan public data—what mcp-taiwan-legal-db and Twinkle Hub are each good for
Two MCP servers wrapping Taiwan's public data sources—one focused on court judgments and statutes, the other aggregating 52,960 government open datasets plus 37 local utility tools. They turn out to be complementary; I now run both.
-
台灣公開資料兩個 MCP 評測——mcp-taiwan-legal-db 跟 Twinkle Hub 各適合什麼場景
兩個串接台灣公開資料的 MCP server——一個專精法律判決跟法規查詢、一個聚合 5.3 萬筆政府開放資料 + 37 個在地工具。實測下來各有強項，課程跟導入場景的搭配方式不一樣。