Member-only story
Debunking: GitHub MCP Exploited
Recently, a blog post titled “MCP GitHub Vulnerability” (see here) makes some broad claims about Model Context Protocol (MCP) servers, GitHub, and AI agent behavior. While it’s valuable to scrutinize the security of emerging systems, this title is ultimately misleading. It conflates architectural design with implementation error, and wrongly attributes responsibility for bad security practices to the protocol rather than its misuse.
Let’s unpack the key issues and clarify what MCP is, what it’s not, and why this criticism misses the mark.
🧠 First, What Is MCP?
The Model Context Protocol (MCP) is a deterministic function-calling architecture. It provides a structured interface between a language model and external tools, allowing the LLM to suggest which tool to invoke based on natural language context. However, MCP itself does not execute anything. It merely suggests an action; the execution is entirely under the control of the developer or agent runtime.
You, as the developer, remain in control of:
- Which tools are registered
- What data is passed to each tool
- Whether tool suggestions are executed at all
This means that calling MCP “vulnerable” due to misuse is like blaming HTTP for a server-side…
