Your Laravel MCP tool returns every column, and three lines of code hide it
This story is from 2026-09-09. It is preserved in the archive; the latest stories are on the live feed.
This is the first MCP tool nearly everyone writes: class TicketTool extends Tool { public function handle ( Request $request ): Response { return Response :: structured ( Ticket :: find ( $request -> get ( 'id' ))); } } It works, and it contains three separate security failures that are not visible…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-09-09 17:03 · DEV Community — AI
Your Laravel MCP tool returns every column, and three lines of code hide it