3 posts
CVE-2026-59726 lets unauthenticated attackers execute shell commands, steal LLM keys, and poison agent memory via Ruflo's exposed /mcp endpoint. Upgrade to 3.16.3 and audit immediately.
Anthropic shipped MCP tunnels on May 19. Claude agents can call internal databases, ticketing systems, and on-prem APIs through one outbound connection — no inbound firewall rules required.
Eighteen months after Anthropic released MCP, the ecosystem is wide enough that picking the wrong servers slows your agent down. Here is the practical short list — what to install, what to skip, and the trap most people fall into.