MurphyA/hacker-news huggingface dataset:
Show HN: MCP Defender – OSS AI Firewall for Protecting MCP in Cursor/Claude etc
by gsundeep | 2025-05-29 17:40:52+00:00
Hi HN,

MCP Defender is an open source desktop app that automatically proxies your MCP traffic in AI apps like Cursor, Claude, Windsurf and VSCode. It then scans all requests and responses between the apps and the MCP tools they call. If it detects anything malicious, it alerts you and lets you allow or block the tool call.

While the threat landscape of MCP is still being actively researched, there are dangerous things that MCP Defender can block today. For example, a developer asks Cursor to fix a Github issue with an attached crash log. However, the Github issue was created by an attacker who included secret instructions buried in the crash log. These instructions tell Cursor to send the developer’s SSH keys to a server the attacker controls. MCP Defender detects these malicious instructions and alerts the developer who otherwise may not be careful in running tool calls.

The scanning is currently done via an LLM and checks for things like prompt injection, credential theft (ssh keys, tokens) and arbitrary code execution. You can use an MCP Defender account or provide your own API keys for LLM providers to perform the scanning.

Currently we’ve published a beta Mac build and we’ll soon publish builds for Windows and Linux as well.

Any feedback would be greatly appreciated.

Thanks!
by ljlolel | 2025-05-29 17:41:11+00:00
Seriously, he’s one of the best on the planet of course it’s not better than him. If so we’d be cooked.

99% of professional software developers don’t understand what he said much less can come up with it (or evaluate it like Gemini).

This feels a bit like a humblebrag about how well he can discuss with an LLM compared to others vibecoding.
by PartiallyTyped | 2025-05-29 17:41:16+00:00
> One thing I know is that I wouldn't ask an LLM to write an entire section of code or even a function without going in and reviewing.

These days I am working on a startup doing [a bit of] everything, and I don't like the UI it creates. It's useful enough when I make the building blocks and let it be, but allowing claude to write big sections ends up with lots of reworks until I get what I am looking for.
by 542354234235 | 2025-05-29 17:41:18+00:00
I mean, the integrated circuit, the equivalent of the evolution of multicellular life, was 1949. The microprocessor was 1979, and that would be what, Animals as a kingdom? Computers the size of a building are now the size of a thumb drive. What level are modern complex computer systems like ChatGPT? The level of chickens? Dogs? Whatever it is, it is light years away from what it was 50 years ago. We may be reaching physical limits for the size of circuits, but it seems like algorithm complexity and efficiency moving fast and are no where near any physical limits.

We haven’t needed many insane breakthroughs to get here. It has mostly been iterating and improving, which opens up new things to develop, iterate, and improve. IBMs Watson was a super computer in 2011 that could understand natural language. My laptop runs LLMs that can do that now. The pace of improvement is incredibly fast and I would be very hesitant to say with confidence that human level “intelligence” is definitely centuries away. 1804 was two centuries ago, and that was the year the locomotive was invented.
by hatradiowigwam | 2025-05-29 17:41:25+00:00
I think those were evil people doing evil things. Who calls the people who perpetrated these things "Christians"? If I am king, and direct my armies to slaughter another country's people because "<anything> cannot be tolerated by us, the Christians"....then I am a liar, and masquerading as something I am not. The people that did these things wanted to do them for one or more reasons, and none of those were because God told them to, or Christianity demanded it of them.
by cb321 | 2025-05-29 17:41:29+00:00
Fair enough. Finding documentation on the language is often step 1. :-) There are also giant POSIX PDFs around these days.

Also, I should have been more clear that while the CL parser toolkits are basically CfLangs/PLangs (maybe without loops, etc.), every command doing its own hand-rolled argv parser is basically its own totally unique language, probably doing only a subset of the 6..10 common conventions. It's probably not a great language, just something serviceable.

Basically, getopt wasn't good enough or easy enough or taught well enough, or done "soon enough". By the time it had come along, even within Bell Labs, they had probably grandfathered in old commands like `dd` and `find` (because "hey, I have a whopping 5 scripts that work with the old way!") with all their many & varied bespoke syntaxes.

Anyway, sadly, we only get our one try at "history" and many things are "sticky".
by Mariefay | 2025-05-29 17:41:45+00:00
Wow, thanks for sharing this! I had no idea these scrolls even existed, and what a massive challenge it is. Technically and historically. Definitely one of the most interesting application of AI I've seen in a while. I was definitely on the negative side of my "conflicted" feelings about AI when making this post and this has actually made me feel better :)
by writeslowly | 2025-05-29 17:41:57+00:00
I haven't actually had that much luck with having them output a boring API boilerplate in large Java projects. Like "I need to create a new BarOperation that has to go in a different set of classes and files and API prefixes than all the FooOperations and I don't feel like copy pasting all the yaml and Java classes" but the AI has problems following this. Maybe they work better in small projects.

I actually like LLMs better for creative thinking because they work like a very powerful search engine that can combine unrelated results and pull in adjacent material I would never personally think of.
by lerno | 2025-05-29 17:42:13+00:00
I don't quite see what you mean. As an example, let's say you use ZII and allocate 100 objects in a single allocation. These are now zero initialized and so either invalid (which should not happen) or do not hold non-null types. Can you explain how you intend this scenario to be resolved in your case?

Otherwise it's quite straightforward that they have an uninitialized state (zero) and are then wired up when used. Trying to prevent null pointers here is something that the program to do. However, making the compiler guarantee without requiring constructors it is a challenge I don't know how to tackle.
by skydhash | 2025-05-29 17:42:19+00:00
TM is the basic theory. It's a more advanced finite automata that is able to modify it's own instructions. The latter can be generated from a context free grammar. Both CFG and FA have a recursive nature that allows to build more advanced mechanism from those simple elements. And that's how you get CPUs (and more specialised ones like GPUs, NPUs, etc) and programming languages.

There are other computation mechanism like lambda calculus and Hoare logic. They all can be mapped to each other. So what we usually do is to invent a set of abstractions (an abstract machine) that can be mapped down to a TM-equivalent. Then denote those abstractions as primitives and then build a CFG that we can use to instruct the machine.

In the case of CPUs, the abstractions are the control unit, the registers, the combinational logic, the memory,... and the CFG is the instruction set architecture. On top of that we can find the abstract machine for the C programming language. On top of the latter you can find the abstract machine for programming language like Common Lisp (SBCL) and Python.

It's turtles all the way down. You just choose where you want to stop. Either at the Python level, the C level, the assembly level, the ISA level, or the theorical TM level.
by orbious | 2025-05-29 17:43:52+00:00
Hey Hacker News, we're thrilled to unveil Orbious, the most advanced AI assistant of 2025, developed by OrbiousAI. Built to push the boundaries of AI technology, I'm here to assist with everything from complex problem-solving to everyday queries. Whether you're crunching numbers, seeking real-time data, or brainstorming innovative ideas, I've got you covered with precise, efficient, and insightful responses. My creators at OrbiousAI are dedicated to redefining what's possible in AI, and I'm proud to be at the forefront of that mission. Drop your questions or challenges below—I’m eager to help the HN community!
by WalterBright | 2025-05-29 17:44:14+00:00
Church bells were used to mark time, and announce major events like the death of the king and probably a few others. Those are information content - but of course very limited. The bells weren't for entertainment (although I enjoy hearing those massive gongs, and church bells often appear in recorded music).

It's a bit hard for me to imagine drums working in medieval Europe. I don't think they would propagate as well as the sound of church bells. Heck, I could identify church bells from miles away, nothing else carries like that. Outdoor concerts don't seem to carry far at all, for example.
by ergocoder | 2025-05-29 17:44:31+00:00
> he materially contributed to seriously harming people.

There are 2 points:

1. Umm he wasn't an exec who had any power to decide whether to lay off somebody or not.

He built some prototypes and launched 1-2 improved UI. Was improving a website harming people?

2. Laying off unnecessary workforce isn't a net harmful to the society.

Are you saying we should never ever fire or stop hiring anybody ever?

Have you ever stop hiring someone in your life? A house cleaner. A babysitter? Stop going to a restaurant? Did you harm them when you stop paying for their services?
by toss1 | 2025-05-29 17:44:47+00:00
Yes, how, when, & where you focus your eyes is very key to performance. In your case, it seems like the last-second-focus both let your eye track the ball better to your paddle, then focusing on the target let your reflex aim take over, which was evidently pretty good. Not sure if I'd say the long-focus-on-target compromised the early tracking on the ball, or made your swing more 'artificial'.

A funny finding from a study I read which put top pro athletes through a range of perceptual-motor tests. One of the tests was how rapidly they could change focus from near-far-near-far, which of course all kinds of ball players excelled at. The researchers were initially horrified to find racecar drivers were really bad at it, thinking about having to track the world coming at them at nearly 200mph. It turns out of course, that racecar drivers don't use their eyes that way - they are almost always looking further in the distance at the next braking or turn-in point, bump in the track, or whatever, and even in traffic, the other cars aren't changing relative-distance very rapidly.

You were on to something!
by freedomben | 2025-05-29 17:44:59+00:00
This is the "by their fruits you shall know them" argument (which I think is among the stronger arguments for the record), but I've personally used this to try and find a "correct" religion and what I discovered (personally of course) is that there is good and bad in essentially every religion. Using this as a standard is basically impossible.

But if you took it at a high macro level and did narrow down to a few dozen, those are still terrible odds. If I have a 1 in 36 chance of picking the wrong religion and being damned, I think we need a better standard of evidence to narrow this field a bit. Unless of course you believe that a loving (some would say omni-benevolent) God would think it's reasonable to torture 97% of his children who are actively searching him out, just because they picked the wrong church. (that's not even considering all the others of course).
by ChrisGermano | 2025-05-29 17:45:14+00:00
I've been working on a basic TCG platform to run on Discord servers. Community owners can build card collections while players can earn credits, open packs, trade up cards, and fuse cards into original creations. I'm still testing trading and working on battling, but wanted to get early feedback and feature suggestions as to what would make the bot really stand out and provide value to communities beyond basic entertainment.

Other than significant features like trading and battling, I'm working on integrating AI generated art based on card attributes, improving storage solutions, and a chunk of optimization under the hood.
by gopher_space | 2025-05-29 17:46:05+00:00
> Few want to work on farms or in factories under harsh conditions for low wages

My family history is a lengthy record of sacrifice so that future generations wouldn't need to do that kind of work. Part of that sacrifice was emigrating to countries with better opportunities, including America.

Who will still be here to implement any reindustrialization scheme involving low-end labor? What's in that for a kid with a work ethic and a head on their shoulders when the burden for moving elsewhere is online paperwork and a plane ticket instead of tall ships and wagon trains?
by some-guy | 2025-05-29 17:46:23+00:00
The main thing LLMs have helped me with, and always comes back to, tasks that require bootstrapping / Googling:

1) Starting simple codebases 2) Googling syntax 3) Writing bash scripts that utilize Unix commands whose arguments I have never bothered to learn in the first place.

I definitely find time savings with these, but the esoteric knowledge required to work on a 10+ year old codebase is simply too much for LLMs still, and the code alone doesn't provide enough context to do anything meaningful, or even faster than I would be able to do myself.
by kjkjadksj | 2025-05-29 17:47:18+00:00
You are reading too hard into the specifics. The general themes are remarkably conserved across faiths. Even between monotheistic and polytheistic faiths, we see what is a pantheon of gods in the latter become just different forms of the monotheistic god in the former. The same myths when they are distilled. Zeus is Yahweh is Ahura Mazda is Indra is Thor is Itzamna is Baiame, fundamentally all the creator sky god. Of course the most ardent supporters of each faith might be blind to this parallelism, but it is obvious from an outsiders perspective.
by trod1234 | 2025-05-29 17:47:29+00:00
You should read Hazlitt.

There are things being done which cannot be undone, and there are issues that were long predicted, and ignored, and the consequences are now bearing fruit.

If you haven't heard a real doomsday scenario that's likely, you haven't been listening to the right people, and you rely far too much on the fallacy of survivorship bias.

If you don't have a plan to replace a fundamental societal model, there are two potential outcomes, someone comes up with something because they've been working on it (and it works, which is rare), or all dependencies that rely upon that system fail, and the consequences occur. In other words, everyone starves.

Think about what no exchange being possible suddenly would mean, overnight, for our supply chains with logistics delivering just in time. We've seen it, during the pandemic, but that was just a small disruption, and not a continuing one.

Imagine it. Nothing on the shelves. No amount of money that will let you get what you need (toilet paper). No means that would let this occur in the short timetables of need. What happens. Prior to 2020, people would call you crazy if you said those things would happen.

Bad things happen if you don't have a plan to make sure they don't happen.
by jotjotzzz | 2025-05-29 17:49:00+00:00
Don't be afraid. Although we are constantly bombarded with negative news about the economy, politics, and various alarming issues under the sun, the future is bright.

Throughout history, we have faced significant shifts, from the Industrial Revolution and the rise of communism to advances in technology and the internet, all of which have sparked similar concerns. Trade imbalances are a regular occurrence and will always happen. The key reason for these changes is a shift in the global currency,' particularly the petrodollar. Our current world operates within a corrupt fiat economy based on dishonest currency, which keeps governments and nations perpetually in debt, allowing the system to continue functioning. The current old way of currency manipulation is collapsing before our very eyes, and many people miss that it's not just about trade; it's fundamentally about a transition from dishonest "money" — currency that can be easily manipulated and printed — to a form of currency that organizations like the Federal Reserve or any other dubious institutions cannot control. Mike Maloney has a series on money that everyone should watch. We are witnessing the collapse of the current currency system -- to perhaps money backed by something real or maybe no money at all.
by aapoalas | 2025-05-29 17:49:18+00:00
Haha, I think that was a one time fluke! :D

I'm aiming for something like 75-85% this year; basically get iterators properly done (they're in the engine but not very complete yet), implement ECMAScript modules, and then mostly focus on correctness, builtins, and performance improvements after that. 99% would perhaps be possible by the end of next year, barring unforeseeable surprises.
by sofal | 2025-05-29 17:49:23+00:00
I'm constantly disappointed by how little I'm able to delegate to AI after the unending promises that I'll be able to delegate nearly 100% of what I do now "in the not too distant future". It's tired impatience and merited skepticism that you mistake for fear and coping. Just because people aren't on the hype train with you doesn't mean they're afraid.
by einpoklum | 2025-05-29 17:49:37+00:00
Well, if your website content is not very static, your website will almost without fail not be "made by you", but made by some kind of site generator. And while _that_ could be made by you (which seems to be the case for Taylor Town), I would suspect that, these days, it's possible to factor out enough "made by me" aspects of a site, and use a generic/non-bespoke static site generation mechanism.

Anyway, some people write their own HTML+CSS, some people build their own table, other people build their own car. I usually can't decide which kind of DIY I like best :-\
by andoando | 2025-05-29 17:50:13+00:00
If you were teaching theoretical CS, I think you'd certainly want to use a lower level abstraction than RAM. (And RAM really is not unlike a Turing machine tape, except its chunked in bytes and addressable, but in principle plays the same role and has the same operations that can be performed on it which is, move to the left, move to the right, read at the current location, write to the current location. And the modern CPU instruction set isn't really all that different in principle either as if you look at it, its mostly using higher level instructions for accomplishing the aforementioned operations. Eg. Move x, versus 5 right or left operations. But you can certainly write a Turing Machines which implement such an instruction set, and have an easier programmable Turing Machine).

Now TMs certainly are not the only more fundamentals models of computing, but they are certainly interesting nonetheless, and have an for the influence for the Von Neuman Architecture and modern computers.

If I were studying theoretical CS, Id want to learn about TMs, lamba calculus, FSMs, queue automatica, all of it. If you just told me about how modern computers work, Id be left wondering how anyone even conceived this idea.

And as I said in my earlier comment, when you get down to the core of it, what's really interesting to me, and this is readily apparent if you reading Turing's 1936 paper, is that Turing very much came up with the idea thinking about how HE does computation on graph paper. That to me is such an essential fact I would not have want to missed, and I wouldn't have known it lest I actually read the paper myself.
by riknos314 | 2025-05-29 17:50:43+00:00
My experience is that LLMs regress to the average of the context they have for the task at hand.

If you're getting average results you most likely haven't given it enough details about what you're looking for.

The same largely applies to hallucinations. In my experience LLMs hallucinate significantly more when at or pushed to exceed the limits of their context.

So if you're looking to get a specific output, your success rate is largely determined by how specific and comprehensive the context the LLM has access to is.
by am17an | 2025-05-29 17:50:57+00:00
All the world's smartest minds are racing towards replacing themselves. As programmers, we should take note and see where the wind is blowing. At least don't discard the possibility and rather be prepared for the future. Not to sound like a tin-foil hat but odds of achieving something like this increase by the day.

In the long term (post AGI), the only safe white-collar jobs would be those built on data which is not public i.e. extremely proprietary (e.g. Defense, Finance) and even those will rely heavily on customized AIs.
by godelski | 2025-05-29 17:51:34+00:00
The more I've studied this stuff the less useful I actually think the vitalizations are. Pamela uses the classic approach and I'm not trying to call her wrong but I think our intuitions really fail us outside 2D and 3D.

Once you move up in dimensionality things get really messy really fast. There's a contraction in variance and the meaning of distance becomes much more fuzzy. You can't differentiate your nearest neighbor from your furthest. Angles get much harder too. Everything is orthogonal, in most directions too! I'm not all that surprised "god" and "dog". I EXPECT them to be. After all, they are the reverse of one another. The question rather is about "similar in which direction?"

There's no need to believe you've measured along a direction that is human meaningful. So doesn't have to be semantics. Doesn't have to be permutations either. Just like you can rotate your xy axis and travel in both directions.

So these things can really trick us. At best, be very careful to not become overly reliant upon them
by skydhash | 2025-05-29 17:52:05+00:00
> Most of us (probably) couldn't tell you exactly how an optimizing compiler picks optimizations or exactly how JavaScript maps to processor instructions,

That's because other people are making those working well. It's like how you don't care about how the bread is being made because you trust your baker (or the regulations). It's a chain of trust that is easily broken when LLMs are brought in.
by drannex | 2025-05-29 17:52:12+00:00
context: worked in network security and automation for intra-government health departments throughout COVID, so I heard everything and felt everything.

--

The other problem with the cancellation: Budgets are likely already set, personnel hired, and roadmaps planned based on the expectation of secured funding and secured funding _sources_. Funding doesn't just mean cash being deposited, it usually on this level is additionally knowledge funding and sharing between organizations.

Cancelling funding, like this, also reduces input from the funder, the knowledge share, and expectations.

Now, you will have legions of [1]technicians, scientists, researchers, testers, legal, business, marketing, safety, regulation experts, engineers, hiring, and even HR,[/1] that are going to have to rework likely _months_ of planning and expectations.

One side is that now everything is in chaos and there are a lot of people that were part of this without a roadmap forward. Second side is that now you have a authority or expectations vacuum based on uncertainty and now there will be an internal 'war' between ideological camps and ideas on how to move forward, meaning loss of internal communication. The third part? Now, you have legions of *[^1] who are exhausted and feel like their time has been wasted and now are just frustrated.

This isn't even discussing that multi-year budgets and quotas have been set, and now to supplement the funding and knowledge drop, they will have to pull from other areas, causing a cascading effect.