PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Otto Support - Logging and Visibility in MCP Servers

bishopfox.com | blog | #ai-security | #agentic-ai | #mcp | #eu-ai-act | #visibility | #logging | #auditability
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Most MCP servers log almost nothing, leaving SSRF, token minting, and other attacks invisible; the post contrasts a bare default log with a full audit log and covers EU AI Act traceability rules.
Published
Collected

Related coverage

tool · github.com
SpecterOps Skills: Open-Source LLM Agent Skills & MCP Plugin Marketplace for Red Teaming and AppSec
As AI-assisted offensive security evolves from simple prompting to multi-agent architectures, SpecterOps standardizes security craft into declarative skills and MCP interfaces, allowing operators to safely orchestrate complex red team tradecraft and reverse engineering directly through LLM agents.
blog · bughunters.google.com
ESCAL8 2026: Agentic Hacking in the Lion City
Check out this post to learn more about ESCAL8 2026, Google’s annual flagship security conference, coming to Singapore from October 23–25, 2026!
blog · bughunters.google.com
Fixing Debug Log Leakage with Safe Coding
Google explains how unaware logging of complex data structures can leak secrets such as cryptographic keys, and how safe-by-default APIs prevent debug log leakage by design.
blog · portswigger.net
How Burp AT helped expose whistleblower reports via a critical vulnerability that was overlooked for years
A customer story on how Burp AT, Burp Suite's agentic testing capability, helped Orange Cyberdefense analyst Ray Huygen work through 66,000 lines of minified JavaScript to find a critical access flaw that exposed confidential whistleblower reports, and turn the finding into a confirmed exploit.
blog · blog.trailofbits.com
Announcing osquery 5: Now with EndpointSecurity on macOS
osquery 5.0.1 introduces an EndpointSecurity-based process events table for macOS, adapting to Apple's tightened security rules, with a mini tutorial and migration notes from 4.x.
blog · xbow.com
How Attackers Are Using AI & What Defenders Must Do
Attackers are running AI driven attack chains from recon to exploitation in minutes. Here’s what actually changed, and why defenders need AI pentesting to keep pace.
Back