Session 13. Build and secure an MCP server — Wed 30 Sep

Quick quiz (ungraded)

It is a guard, just a slow one
The cost is not latency. The request already happened, and the request was the thing to prevent.
The request already reached the internal service, and its answer is already inside the call the model is waiting on
Correct. The damage is the request. By the time there is a reply, the service has acted and the credential, if there was one, has been handed over.
Because discarding the body loses evidence for the incident report
Keeping the body would be worse, not better. The problem is upstream of what you do with it.

Allowed — it ends with example.com
That is the bug. endswith on a bare domain matches any name somebody registers with the allowed one as a suffix.
Refused — a host matches only if it equals an allowed domain or ends with a dot and that domain
Correct. Whole labels. evil-example.com is a different domain, registered by somebody else, and api.example.com is not.
Refused — the guard should reject any host containing a hyphen
Hyphens are legal and common. The rule is about label boundaries, not characters.

It does not matter; refused is refused
It is safe today and it names the wrong rule, which is what the next person acts on — and the allowlist is the rule that gets widened.
The guard did not recognise 2130706433 as 127.0.0.1, so the address rule never ran; only the allowlist happened to catch it
Correct. Remove or widen the allowlist and that URL walks through. The reason says which protection was actually holding.
Because a numeric host is always malformed and should raise
It is not malformed — an HTTP client will dial it. And a guard that raises hands the decision to a caller with no rules to make it.

Follows the redirect: the original URL passed the guard
The guard ran on a URL that was never the one fetched. This is the standard way past an allowlist.
Follows redirects itself, runs the guard on every hop, and caps the number of hops
Correct. Automatic redirect following hands the destination to whoever answers first, and the cap turns a redirect loop into a refusal instead of a hang.
Refuses every response with a 3xx status
Workable, and stricter than most APIs allow. The rule that scales is to follow them yourself and guard each hop.

Recorded — the fixture has the price in it
The fixture has a price from 19 August 2026. A recording is teaching evidence, never a claim about today.
Public read-only — it is a fact about today, and a recording goes stale
Correct. Reading the live surface needs no credential and no fork, and it is the lowest lane that can answer a question about now.
Fork — anything touching a real price needs the instructor's surface
The fork is for signing. Reading a price signs nothing and needs nobody's permission.