MCP is kind of like Q-Tips.

Someone published an example MCP server to highlight various vulnerabilities^[ot] in MCP.

One of the primary comments in the Hacker News thread said effectively, "You're holding MCP wrong, it should only be used on local, trusted inputs."

That's like telling people to not use Q-tips to clean their ears! ^[ou]