Letting users trust their own MCP clients, without opening a phishing hole

foolswisdom

> It does not stop a determined social engineer In the age of people trying AI for everything and occasionally following instructions the trustworthiness they cannot judge, that's probably the biggest problem. From a security perspective, the lethal trifecta is alive and well. A commercial customer will lock down their mcps (requiring approval by an admin), and there it may make sense to allow adding custom mcp servers. But for consumer accounts, not allowing arbitrary mcps is a conservative move. Though honestly given how the AI labs operate, it's surprising to me that they're not looser with restrictions in the name of more engagement.

JohnMakin

It's like people en masse are discovering OAuth standard for the first time.

ImPostingOnHN

Why would a user click a random link from a random source, asking for oauth access to their account somewhere, and then actually provide their credentials and approve it? Is it a prerequisite that a poisoned agent gives them the link in the current working session, so they think it's related to the session?