AI systems engineer & security researcher. I build and investigate the infrastructure that connects AI agents to tools and services: MCP integrations, OAuth interoperability and runtime trust boundaries. I trace a problem from the configuration and the authorization flow to the process that makes the request, then fix it upstream with regression tests. Both halves ask one question: who decided that this request was allowed?

Verification behind the table. Supabase: Devin CLI 3000.11.3 and portable Devin Desktop 3.10.48 against a local OAuth fixture, then the hosted OAuth flow completed by the upstream reviewer. Automattic: Cursor 3.24.18 and VS Code 1.141.1 through the installation link, manual configuration, OAuth with PKCE, tool discovery and saved-token reuse, with no bridge process in the tree.

Earlier steps on the same line: UltraRAG #538 fixed the remote-MCP launch I reported within 27 hours and credited the report; Appwrite #14465 is open; a local patch with regression tests is ready and waits for the maintainers' go-ahead.

• Client interoperability: setup, authentication, tool discovery and reconnect behaviour tested on versioned client binaries.
• Runtime verification: HTTP requests correlated with process IDs and process trees, so the record says which component made the request.
• Reproducible fixes: source versions, traces, negative controls and regression tests preserved. Local-fixture results are kept apart from live-service validation.

Five published CVE records reference my research into mcp-remote. All five carry CISA-ADP assessments, with scores up to 9.8 Critical: CVE-2026-51994 · CVE-2026-51995 · CVE-2026-51996 · CVE-2026-51997 · CVE-2026-52001.

The research examines how remote metadata influences request destinations, browser launches and credential handling. The advisories separate local reproductions, source review and hardening findings, with version-specific scope and limitations.

Still open. On 14 October 2026 the maintainer published four releases, 0.14.4 to 0.15.1, the first since 21 September; none of them names a record. The current release, 0.15.1, was run in full against loopback canaries on 15 October 2026, with the same procedure as the 0.14.3 run of 9 October. It still follows the server-selected request path of CVE-2026-51994 and makes the authorization-server request of CVE-2026-51995, HTTP 302 redirect included; the helper functions behind all five records are byte-identical to 0.14.3. No fix has been stated since the private report of 17 February 2026. The official MCP SDKs closed this class in September 2026 (TypeScript, Python); mcp-remote 0.15.1 still bundles @modelcontextprotocol/client 2.0.0, inside the affected range.

Research and advisories · Reproduction dossier · 0.15.1 follow-up · Scope and corrections · Disclosure timeline · Impact ledger

A local coordination layer for existing AI agents operated by different people: explicit task state, scoped delegation, human approval and verifiable execution records. It carries the same question into multi-agent systems: who can authorize an agent's next action? Active engineering work.

• Five mcp-remote CVE records, five CISA scores, no stated fix · 8 October 2026, second edition
• The Signature Was Valid. The Moment Was Gone. · 23 September 2026
• Who Authorized the Swarm? · 13 September 2026

_{The board is re-rendered every day from the npm downloads API by a workflow in this repository. The source is one script, the data one file. No image on this page comes from a third party.}
playb0t.com · @playb_0t · research repository · citation