MCP vs UTCP: we timed both on the same 10 tools
On identical tools, a UTCP call took 0.161 ms and an MCP call 0.632 ms. Tool definition size was nearly the same. Here is how to choose.
Wed Nov 04 2026 · 10 min read · 2 views
#mcp
Is your MCP server exposed? 3 of 5 bind every interface
We ran five MCP server setups with default settings. Three listened on every network interface and answered a request from the LAN address. Check yours in 10 seconds.
Wed Oct 28 2026 · 9 min read · 1 views
MCP went stateless: what breaks when versions mix
The MCP 2026-07-28 migration is less frightening than the headlines suggest. The Model Context Protocol removed sessions and its connection handshake, and the official MCP blog says the release
Mon Oct 19 2026 · 10 min read · 4 views
Is your Go MCP server open to DNS rebinding? Check v1.4.0
CVE-2026-34742: Go MCP SDK before 1.4.0 accepts any Host header on localhost HTTP servers. We tested v1.3.1, v1.4.0 and v1.8.0, and show the fix and a proxy trap.
Sat Oct 17 2026 · 9 min read · 2 views
Laravel Boost MCP Servers Failed: The Environment Rule
Laravel Boost shows 'MCP servers failed' when boost:mcp is not registered. The exact environment rule, a tested matrix of seven cases, and the fixes that work.
Thu Oct 15 2026 · 9 min read · 12 views
Your Laravel MCP Server Now Returns 400 After Upgrading
Laravel MCP 1.0 upgrade breaking changes, tested against 0.9.6: new header checks return HTTP 400, sessionId() is gone, and old clients still work.
Thu Oct 15 2026 · 10 min read · 2 views
Does Your MCP Client Leak OAuth Secrets? Check the SDK Version
CVE-2026-104850 lets an MCP server choose where your client sends OAuth secrets. Fixed SDK versions, the expectedIssuer setting and a lockfile check.
Thu Oct 15 2026 · 9 min read · 1 views
Postgres MCP Read-Only Mode Can Be Bypassed
Methodology: every claim below traces to a named security advisory or vendor bulletin, cross-checked between at least two independent sources where both existed. No exploit code was built or run for
Wed Oct 14 2026 · 8 min read · 3 views
Should your Claude connector draw its own UI?
A connector used to be text in, text out. Now it can draw. An MCP App is an MCP server that ships its own interface, and Claude renders it inline in the conversation.
Sat Aug 22 2026 · 5 min read · 14 views
Your MCP connector spends context before you type
The advice you have read about MCP context cost is out of date. The old rule was simple. Every tool you connect gets injected up front, so a big connector spends a chunk of the window before you type
Sat Aug 22 2026 · 6 min read · 9 views
What gets a Claude connector rejected from the directory
Most guides to the Claude Connectors Directory explain how to submit. This one covers what fails. The triggers are published, exact, and easy to hit by accident. The most common one is a design choice
Sat Aug 22 2026 · 6 min read · 13 views
Claude cannot reach your MCP server, but curl can
Claude shows one error for a lot of different problems: Couldn't reach the MCP server. Your server is up. You can curl it. MCP Inspector connects. Claude still refuses.
Sat Aug 22 2026 · 6 min read · 11 views
Claude cannot register with your OAuth server. Now what?
Your remote MCP server works in curl. It works in MCP Inspector. Then you add it to Claude as a custom connector and get this:
Sat Aug 22 2026 · 5 min read · 17 views
Your MCP server failed to start. Five likely causes
MCP server failed to start? Five causes explain almost every case, and stdout logging is the one that hides best. Fix it in the right order.
Thu Aug 20 2026 · 5 min read · 9 views
MCP went stateless. Your server still has state.
The Model Context Protocol shipped a new revision on 28 July 2026. The headline everywhere is the same: MCP is stateless now. That part is true.
Thu Aug 06 2026 · 6 min read · 4 views