A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer's Windows or WSL machine when the developer signed in. OpenCode connects to MCP (Model Context Protocol) servers to add outside tools, and such code would run with the developer's own access. Anomaly, the company behind OpenCode, fixed the flaw inΒ version 1.18.33Β on September
π Search
OpenCode Flaw Lets Malicious MCP Servers Execute Code During Sign-In on Windows and WSLhttps://thehackernews.com/2026/10/opencode-flaw-lets-malicious-mcp.html
Show HN: An open dataset of MCP tool definitions and every change to themhttps://histor.modelmarket.dev/datasets
Article URL: https://histor.modelmarket.dev/datasets/ Comments URL: https://news.ycombinator.com/item?id=50193565 Points: 1 # Comments: 0
Show HN: BlueFacts β Bluesky stats and feeds via MCPhttps://bluefacts.app/bluesky-mcp
I work on BlueFacts a stats site for Bluesky, it tracks accounts, custom feeds, tags etc I added MCP support yesterday so you can create your own feeds eg in claude code, or fetch Bluesky stats. We have a real time search so the agent can quickly iterate and refine the feed, exclude unrelated terms etc. It is free, let me know any feedback you have! Comments URL: https://news.ycombinator.com/item?id=50192633 Points: 1 # Comments: 0
Show HN: A stateless MCP server over our docs β search, list_topics, get_articlehttps://chinaready.co/docs/api
Article URL: https://chinaready.co/docs/api/ Comments URL: https://news.ycombinator.com/item?id=50192268 Points: 2 # Comments: 0
