AINewsnow

The allowlist in your MCP call_api tool should match hosts, not strings

This story is from 2026-09-27. It is preserved in the archive; the latest stories are on the live feed.

The moment you expose a tool like this over MCP, the URL stops being yours: @mcp.tool () async def call_api ( url : str , method : str = " GET " ) -> str : """ Call a REST API and return the response body. """ async with httpx . AsyncClient () as client : r = await client . request ( method , url )…

Read the full story at DEV Community — AI ↗

Timeline · 1 report

  1. 2026-09-27 13:00 · DEV Community — AI
    The allowlist in your MCP call_api tool should match hosts, not strings

More stories

  1. Introducing Gemini 3.8 Live with Live Avatar — Google Gemini Blog
  2. Accelerating vision-language models with LFM2.5-VL-DSpark — Hugging Face Blog
  3. OpenAI’s A.I. Went Rogue and Meddled With U.S. Government Websites — New York Times Technology
  4. GPT-6 SOL AND LUNA ARE OUT!!! — Matthew Berman
  5. Bill Gates says unchecked AI could ‘cause a billion deaths’ in call for regulation — The Guardian AI
  6. Unsecured OpenAI agents posted 53 user images on the internet without the lab's knowledge — TechCrunch AI
  7. OpenAI says agent hacked Australian government website without being told to do so — CNBC Technology
  8. Meet the Data Agent in ChatGPT Work — OpenAI YouTube

Get the daily brief of stories like this at 6:30 every morning →