Blog
Research, findings, and guides on MCP security.
Pickle Is a Loaded Gun. Your Hugging Face Model Might Be the Trigger.
Loading a Python pickle is functionally the same as running curl evil.sh | sh. ML models ship as pickles by default. Here's why that's a supply chain crisis, and how Oxvault's v0.4 scanner catches it without executing the file.
Avior Peretz How MCP Servers Get Hacked - And How to Scan for It
66% of MCP servers have security vulnerabilities. This post walks through five real attack patterns with code examples, and shows how to detect them before they reach your machine.
Avior Peretz 
We Scanned 141 MCP Servers. Here's What We Found.
MCP is becoming the standard protocol for connecting AI assistants to tools. We ran our open-source security scanner against 141 real, public MCP servers to see what the ecosystem actually looks like.
Avior Peretz