Independent security research

Security research on AI, agents, and MCP servers

I find and responsibly disclose vulnerabilities in Model Context Protocol (MCP) implementations and AI-assisted developer tools, then work with maintainers and site operators to get them fixed.

Read the advisories About this research

For website operators

Received a security notice from me?

Verify it is genuine and find the guidance page for the component named in the email. I am not asking for money, passwords, or access to your site.

Check your notice →

Already updated? One more step.

Updating closes the hole from now on. It cannot tell you whether anyone found it first. A practical 30-minute self-check, no security background needed.

I updated. Now what? →

Found something in the self-check you are not sure about? Reply to the notice email. I read every reply.

Recent advisories

View all advisories →