Source

Syed Anas Mohiuddin, security research

1 item

The personal site of an independent security researcher who reports vulnerabilities in Model Context Protocol servers. Primary for the researcher's own findings, dates of disclosure and the fixes vendors confirmed. Severity ratings and fix dates are checked against the vendor advisories the write-up links.

anas-security-portfolio.vercel.app ↗

AI Chatbot Assistants on Glass Blocks, Artificial Intelligence Technology Concept. Digitally generated image. 3d render.

Connectors

The same SSRF bug turned up in MCP servers at Google, JPMorgan, and two governments

An independent researcher reported one class of server-side request forgery to five organizations that share no code, and all five confirmed and fixed it. Google's MCP Toolbox for Databases carried a high-severity CVE until version 1.5.0. Five US federal servers are still open. If you run an MCP server with any tool that fetches a web address, the four checks at the end apply to you.

Ars TechnicaOctober 6verified