Stream Vessel limits MCP phishing risk with per-user trust lists
What happened
On November 4, Hacker News' front page covered Stream Vessel's trust design for MCP callback addresses. The scheme keeps a per-user trust list of callback addresses and checks the address during the authorization step after login, balancing self-built client access with phishing protection. Each account can trust at most 10 exact-match HTTPS addresses. To add an address, the user confirms the hostname through their own browser session. Removing an address revokes the related authorization and any authorization codes not yet redeemed. The protection covers adding addresses, the authorization check, and revocation after removal.
Written by AI from the coverage · updated 2 hours ago
Coverage
Follow the reports to see the story from different sides.
- Hacker News front pageLetting users trust their own MCP clients, without opening a phishing hole
Stream Vessel 采用按用户设置的 MCP 回调地址信任列表，在登录后的授权环节检查地址，兼顾自建客户端接入与钓鱼防护。每个账户最多信任 10 个精确匹配的 HTTPS 地址，添加时需通过本人浏览器会话输入主机名确认，移除时撤销相关授权及尚未兑换的授权码。
Heat over time
Not enough continuous observations to draw a trend yet.