Expired65% confidenceFactTime unknown
The agent using only MCP tools did not set security flags and created a view with a data leakage risk, while the MCP+Skill agent correctly identified and implemented the secure configuration.
3
Sources
65%
Confidence
Medium-term (~90 days)
Relevance
6/3/2026
First Seen
Valid until: 9/1/2026(expired)
Sources
Related Entities
Related Claims
UnverifiedThe MCP protocol itself does not carry risk semantics for tools, and the responsibility for security judgment falls back on the application developers.80% similarVerifiedMCP tools are essentially arbitrary code execution, indirect prompt injection is a real-world threat, and attack vectors can be hidden in resource content rather than in direct user input.79% similarUnverifiedAI agents using MCP+Skill were able to correctly identify and implement the security_invoker security configuration79% similarUnverifiedThe core limitation of MCP is that the existence of a tool must be known in advance and manually connected to the agent before use, lacking an automatic discovery mechanism.76% similarUnverifiedMCP的设计中Server是被动的，不思考、不决策，只暴露工具等着被调用76% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/39570API
curl https://kongchang.com/api/v1/knowledge/claims/39570MCP
get_claim(id=39570)