Sitemap

Member-only story

Debunking: GitHub MCP Exploited

5 min readMay 30, 2025

--

Press enter or click to view image in full size
Intent Analysis — MCP servers

Recently, a blog post titled “MCP GitHub Vulnerability” (see here) makes some broad claims about Model Context Protocol (MCP) servers, GitHub, and AI agent behavior. While it’s valuable to scrutinize the security of emerging systems, this title is ultimately misleading. It conflates architectural design with implementation error, and wrongly attributes responsibility for bad security practices to the protocol rather than its misuse.

Let’s unpack the key issues and clarify what MCP is, what it’s not, and why this criticism misses the mark.

🧠 First, What Is MCP?

The Model Context Protocol (MCP) is a deterministic function-calling architecture. It provides a structured interface between a language model and external tools, allowing the LLM to suggest which tool to invoke based on natural language context. However, MCP itself does not execute anything. It merely suggests an action; the execution is entirely under the control of the developer or agent runtime.

You, as the developer, remain in control of:

  • Which tools are registered
  • What data is passed to each tool
  • Whether tool suggestions are executed at all

This means that calling MCP “vulnerable” due to misuse is like blaming HTTP for a server-side…

--

--

Philippe Bogaerts
Philippe Bogaerts

Written by Philippe Bogaerts

#BruCON co-founder, #OWASP supporter, Application Delivery and Web Application Security, #Kubernetes and #container, #pentesting enthousiast, BBQ & cocktails !!