AI systems engineer & security researcher. I build and investigate the infrastructure that connects AI agents to tools and services: MCP integrations, OAuth interoperability and runtime trust boundaries. I trace a problem from the configuration and the authorization flow to the process that makes the request, then fix it upstream with regression tests. Both halves ask one question: who decided that this request was allowed?
| Project | Status | Contribution |
|---|---|---|
| Supabase | Merged, 14 October 2026 | Moved the Devin MCP preset from an unpinned mcp-remote bridge to native HTTP configuration, removed the dead bridge type, added shared setup instructions and brought Devin into the common client URL round-trip test. 4 files, +46/−38, 273 package tests. |
| homarr-labs / dashboard-icons | Merged, 19 October 2026 | Moved the MCP setup dialog's VS Code, Claude Code, Claude Desktop, Windsurf and Zed tabs from an unpinned mcp-remote bridge to native HTTP connections; the custom-client tab keeps the bridge, pinned to 0.15.1. 5 files, +119/−30, 12 Chromium dialog tests. The maintainer checked every tab and merged with a fix of his own on top. |
| homarr-labs / dashboard-icons | Merged, 20 October 2026 | Found while preparing the change above: the MCP route skipped the OAuth sign-in challenge and the per-call rate limit for legacy JSON-RPC batches. The fix reads every tools/call in a batch, challenges before dispatch and sizes the body limit by request class. 3 files, +482/−9, 1,572 tests. |
| Alibaba Cloud / iac-code | Merged, 20 October 2026 | Replaced the npx mcp-remote wrapper example in the MCP passthrough documentation with a local stdio server, in English and six locales, with a note that a remote HTTP server needs no wrapper. 15 files, +76/−72, 139 pytest checks and the docs site built for seven locales. |
| rtk-ai/rtk | Merged | SHA-256 integrity verification for installed agent hooks. Operational commands refuse to run when the hook differs from its recorded baseline. Writeup and limitations. |
Verification behind the table. Supabase: Devin CLI 3000.11.3 and portable Devin Desktop 3.10.48 against a local OAuth fixture, then the hosted OAuth flow completed by the upstream reviewer. dashboard-icons: the generated configurations and the dialog's Chromium tests locally, then every client tab checked by the maintainer at two viewports before the merge; the batch fix against a loopback PocketBase fixture, with the gap first reproduced on the unmodified head. Alibaba Cloud: the documentation site built for seven locales and every snippet checked on the built pages.
Earlier steps on the same line: UltraRAG #538 fixed the remote-MCP launch I reported within 27 hours and credited the report; Appwrite #14465 is open; a local patch with regression tests is ready and waits for the maintainers' go-ahead.
- Client interoperability: setup, authentication, tool discovery and reconnect behaviour tested on versioned client binaries.
- Runtime verification: HTTP requests correlated with process IDs and process trees, so the record says which component made the request.
- Reproducible fixes: source versions, traces, negative controls and regression tests preserved. Local-fixture results are kept apart from live-service validation.
Five published CVE records reference my research into mcp-remote. All five carry CISA-ADP assessments, with scores up to 9.8 Critical: CVE-2026-51994 · CVE-2026-51995 · CVE-2026-51996 · CVE-2026-51997 · CVE-2026-52001.
The research examines how remote metadata influences request destinations, browser launches and credential handling. The advisories separate local reproductions, source review and hardening findings, with version-specific scope and limitations.
Still open. On 14 October 2026 the maintainer published four releases, 0.14.4 to 0.15.1, the first since 21 September; none of them names a record. The current release, 0.15.1, was run in full against loopback canaries on 15 October 2026, with the same procedure as the 0.14.3 run of 9 October. It still follows the server-selected request path of CVE-2026-51994 and makes the authorization-server request of CVE-2026-51995, HTTP 302 redirect included; the helper functions behind all five records are byte-identical to 0.14.3. No fix has been stated since the private report of 17 February 2026. The official MCP SDKs closed this class in September 2026 (TypeScript, Python); mcp-remote 0.15.1 still bundles @modelcontextprotocol/client 2.0.0, inside the affected range.
Research and advisories · Reproduction dossier · 0.15.1 follow-up · Scope and corrections · Disclosure timeline · Impact ledger
A local coordination layer for existing AI agents operated by different people: explicit task state, scoped delegation, human approval and verifiable execution records. It carries the same question into multi-agent systems: who can authorize an agent's next action? Active engineering work.
- Five mcp-remote CVE records, five CISA scores, no stated fix · 8 October 2026, second edition
- The Signature Was Valid. The Moment Was Gone. · 23 September 2026
- Who Authorized the Swarm? · 13 September 2026
The board is re-rendered every day from the npm downloads API by a workflow in this repository. The source is one script, the data one file. No image on this page comes from a third party.
playb0t.com · @playb_0t · research repository · citation