Home / Blog

Blog

Disclosures, design notes, and what we ship. Built for humans and for the machines that read this in your stead — every post has a plain-text mirror.

4 May 20266 min readsecurity · mcp · supply-chain
How MCPlexer mitigates the MCP STDIO RCE class
Anthropic's MCP STDIO transport spawns whatever command a downstream config declares. OX Security disclosed it as a systemic RCE vulnerability in April 2026. We treat it as our responsibility.
Read post