x.comthreadSwif (@swif_ai) on X
Swif (@swif_ai) reports that in the MCP TypeScript server SDK versions 2.0 to 2.2, a single server instance shared by several HTTP clients, which is the pattern the README shows, could send one client's responses to another client. Version 2.3.0 refuses this setup, so developers must build a server per request or per session. The post gives no CVE, advisory ID or technical detail.
TL;DR MCP TypeScript SDK 2.0-2.2 could leak responses between HTTP clients sharing one server instance; 2.3.0 refuses it.
Also seen from another angle🧠 AI →
Organisations named here
- cross-client data leak
Technologies named here
- MCP TypeScript server SDK
- MCP TypeScript server SDK 2.0 to 2.2
- Model Context Protocol
- TypeScript
Techniques named here
- Cross-client response leakage
Related in AI Security
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
github.comadvisoryFlowise MCP Security Bypass Enables RCE
github.comrepoYesWeHack Claude Kit
jfrog.comarticle