File Processing Makes MCP Feel Less Toy-Like, and a Lot More Dangerous
What jumped out at me is that this article is basically a reminder that “MCP server” is not the interesting part; the interesting part is the thing you let the server do. A read-only tool can get away with a lot of sloppy thinking. The moment you let a model hand your server a file path or a URL and then do real work on it, the comfy demo assumptions start falling apart. The SSRF angle is the one I’d take most seriously. If a tool accepts a URL, then you are no longer just validating input, you
papoo.work