Here is a failure that does not look like a bug in code review, passes every test you wrote, and quietly hands an attacker your privileges. It is called the confused deputy, and it is the reason "just forward the token" is one of the most expensive shortcuts you can take in an MCP server. The d...

Source: [Dev.to](https://dev.to/guybrushulyssesthreepwood/the-confused-deputy-or-why-just-forward-the-token-breaks-your-mcp-server-hap)

Sponsored