Infrastructure
MCP Ships 40+ CVEs Into a Protocol About to Lock Them In
STDIO transport passes parameters to the OS shell without sanitization. Authentication is optional. When the Jul 28 release candidate ships, these architectural choices become permanent by design.
◆ Blair Hayes