Remix clone Hacker News

There seems to be a fundamental misunderstanding at play here.

The MCP spec makes it pretty clear that MCP servers are expected to be run in environments that are implicitly trusted/trustable for any client that can reach them. This is clear from the default/assumed stdio transport, but even with SSE the protocol expects auth to be already-solved.

In short, MCP servers are not meant to be accessible as public APIs -- as ChatGPT puts it, MCP assumes that its transport is inherently trusted. It doesn't seem like this is widely understood.

▲

throwaway290 6 days ago | parent | next [-]

We learn again and again: there are no totally trusted environments

▲

BeetleB 7 days ago | parent | prev | next [-]

Yes. I've written my own server and feel totally secure in using it, because I have complete control over what it can do (example, I let it send mail, but only to my email address).

If you want it to write to disk, you can put explicit controls on where, and what file size, and whether it can overwrite.

If you want it to read from disk, you can restrict to a simple whitelist that doesn't have confidential/private information.

I have not yet used open source servers out there, because it's a lot of burden for me to limit it to only what I allow.

▲

lolinder 7 days ago | parent [-]

How did you get started writing your own and hooking it up? Were you just working off the spec, or are there any guides or docs you'd recommend?

▲

mindcrime 7 days ago | parent | next [-]

Not the person you asked, but I've gone down this rabbit hole recently and can maybe add something. First, let me say that I don't find much value in the stdio transport stuff and really only care about the http/sse side.

Given that, I found that the docs at modelcontextprotocol.org are somewhat lacking. They seem to assume that you want to use stdio and don't have much meat on setting up sse.

The good news is, the official Python SDK repo has examples of both scenarios. Between the actual "example servers" in the examples/ dir[1], and comments sprinkled around some of the various module files[2][3] themselves, everything you need to write an sse based server/client pair (in Python at least) is there. Note that most of what I just said is true mainly if you want to use the lowlevel / "vanilla" SDK. Using FastMCP makes things a lot simpler and faster.

If you're interested, I keep a repo with some of my experiments and samples as I'm learning this stuff. Feel free to poke around there and see if any of those examples help:

https://github.com/mindcrime/MCPSandbox

I've got FastMCP and "vanilla SDK" examples of sse server/client pairs, and a stdio based example mostly cribbed from the "quickstart guide".

My next step is going to be to start working with the Java SDK, so some Java samples will probably show up there soon'ish.

[1]: https://github.com/modelcontextprotocol/python-sdk/tree/main...

[2]: https://github.com/modelcontextprotocol/python-sdk/blob/main...

[3]: https://github.com/modelcontextprotocol/python-sdk/blob/main...

	▲	kiitos 7 days ago \| parent [-]
		> I don't find much value in the stdio transport stuff and really only care about the http/sse side ... I found that the docs at modelcontextprotocol.org are somewhat lacking. They seem to assume that you want to use stdio and don't have much meat on setting up sse. Yeah, it's expected that you'll use stdio by default, because it's expected that MCP servers run locally to the client that connects to them, and in that case stdio is both simpler and faster.

▲

MattSayar 7 days ago | parent | prev | next [-]

I set up a Project in Claude, used the Github integration to point to the Python example code [0], threw in my API docs, and told it to go forth and create. It was a workable start. Very much just a prototype, but it worked out of the box.

[0] https://github.com/modelcontextprotocol/python-sdk

▲

voxic11 5 days ago | parent | prev | next [-]

Its trivial to write your own server with one of the MCP server SDKs. I used https://github.com/modelcontextprotocol/typescript-sdk

▲

kordlessagain 6 days ago | parent | prev | next [-]

If you have Windows, I'm working on this: https://github.com/kordless/evolveMCP/

▲

BeetleB 7 days ago | parent | prev | next [-]

Just used FastMCP and the sample code on the official MCP site.

▲

wetpaws 7 days ago | parent | prev [-]

[dead]

▲

halJordan 7 days ago | parent | prev [-]

That concept has been replaced for years at this point with Zero Trust. A greenfield project intended to the "The Protocol" tm should never have been made with such a broken threat model.

	▲	kiitos 9 hours ago \| parent [-]
		This is such a boring perspective. Zero Trust is the spherical cow of trust models. When you do a DHCP request to your local DHCP server, you're trusting that local relationship implicitly. When you PPPoE (or whatever) to your ISP, you're trusting that client/server relationship. When you DNS lookup www.google.com you're trusting the global DNS infrastructure. It goes on and on and on. Every communication from client to server necessarily requires some amount of trust by the client in the server by definition.