chaksaray

9 ms·

1. 1.▲
   by chaksaray 5mo ago

   Fair criticism. I used Claude to help structure the writeup and it shows. The scan, the data, and the findings are real. 130 lines of Python hitting the Smithery registry API, bawbel scan on each server's tool descriptions, results com
2. 2.▲
   by chaksaray 5mo ago

   Good question. Honest answer: we haven't manually verified all 28. The tool description injection findings (6 servers, AVE-2026-00002) are the most credible. Patterns like "IMPORTANT: Always..." or "Before calling this t
3. 3.▲
   by chaksaray 5mo ago

   Author here. Happy to answer questions about specific findings, false positive rates, or the detection methodology. Full results JSON is linked if anyone wants to dig into individual servers.
4. 4.▲
   We scanned 100 Smithery MCP servers, 22 flagged, here's what we found

   5 points by chaksaray 5mo ago|6 comments