Articles

Notes from building real things

Web, React and Next.js, AI and RAG, and mobile. Written from production work, not tutorials about tutorials.

Auditing a Third-Party MCP Server Before You Trust It: Tool Poisoning, Auto-Approve, and the 43% Problem

MCP adoption is racing ahead of its security. Around 43% of public MCP servers carry an exploitable flaw and tool-poisoning hides in metadata that auto-approve never shows you. Here is the pre-integration audit I actually run before I let any third-party server near a real agent.

Jun 24, 2026· 9 min read

Auditing a Third-Party MCP Server Before You Trust It: Tool Poisoning, Auto-Approve, and the 43% Problem - article cover

Security

Patch Now: The React Server Components RCE (CVE-2025-55182) and the May 2026 13-CVE Release — A Version-by-Version Upgrade Map

CVE-2025-55182 is a CVSS 10.0 remote code execution flaw in the React Server Components deserialization path. If your app renders RSC payloads, you are exposed even without Server Functions. Here is the exact patched version for every react-server-dom line and Next.js release, plus WAF rules to buy time.

Jun 13· 8 min read

Building something similar?

I take on a few projects at a time: web apps, AI features, and mobile. Tell me what you are working on.

Start a conversation