company
Cycode is an application security company that researches vulnerabilities and helps secure software supply chains and code repositories.
MCP Python SDK maintainers rated a flaw that let a connected server choose where OAuth secrets were sent High, at 7.5. For its two machine-to-machine providers, upgrading changes nothing until the client names the issuer it expects.
Reality
MCP Python SDK releases 1.30.0 and 2.2.0 leave a credential-theft bug open for two OAuth providers unless their constructors pass an issuer. For unattended MCP clients the fix is a one-argument code change, and each team has to find and make it in its own source.
Reality
MCP Python SDK maintainers fixed a flaw rated up to 7.5 that lets malicious servers steal OAuth client secrets, in versions 1.30.0 and 2.2.0. Two of the affected providers stay exposed after upgrading until the calling code passes issuer=.
Reality
A flaw in NASA's open-source AIT-GUI lets unauthenticated requests reach spacecraft command routes, and Cycode says a malicious web page can deliver them through an operator's browser.
Perspective Coverage
4 publishersReality
Nir Nave, Cycode's VP Product Research, told Lets Data Science that completing a cooldown is not proof a package is safe. Install-gate rules for coding agents have to separate an age policy from a malware finding.
Reality
Cycode's Workstation Protection, now in early access, screens installs against a threat intelligence feed and holds back packages updated too recently to vet. It ships inside the device management module Cycode already installs.
Reality
GitHub now sells Advanced Security as two SKUs, at $19 and $30 per active committer per month. Neither one routes a finding to an owner or enforces a deadline.
Reality