Skip to content
ToolMesh
Blog

Blog

OWASP MCP Top 10: What a Gateway Fixes — and What It Doesn't

Axel Dunkel

The OWASP MCP Top 10 (v0.1, beta) names ten risk categories for Model Context Protocol deployments. Mapped against a gateway’s enforcement pipeline, not one of them closes fully: some attack paths disappear by construction, others depend on a default that ships switched off, and MCP06 sits outside the boundary. With the exposure figures from arXiv 2608.00150, the NSA AISC design considerations, and the MCP06 title discrepancy on OWASP’s own page.

MCP Goes Stateless — What It Means for Your Gateway

Axel Dunkel

MCP 2026-07-28 makes the protocol stateless: sessions removed, routable headers required, and Sampling, Roots, and Logging deprecated on a twelve-month clock. What to check in your own MCP servers now, why the new spec reads as if it expects a gateway — and what a gateway honestly does not solve. Full change table with SEP references included.

Editing Files Without an Editor

Axel Dunkel

An LLM has no cursor and no reliable sense of line numbers — so how does it change a file? Line numbers drift; exact quotes fail closed. A practical design for LLM file-editing APIs: content-as-address, the ambiguity round-trip, and optimistic concurrency.

Xen Orchestra's Full REST API — 252 Tools from One DADL

Axel Dunkel

Xen Orchestra stabilized its REST API in 6.4, and every release since has added a handful of endpoints — 6.6 brought writable backup repositories and PATCH for VDIs and VIFs. Vates ships a first-party MCP server — 7 tools, read-only by design. We took a different cut: the entire 252-endpoint surface, read and write, as one DADL. Both belong in the same registry. Here is why.