r/ClaudeMCP

https://github.com/aikadimsoy/kasa-mcp/discussions/1 https://huggingface.co/datasets/Earthen937/kasa-mcp-indirect-channel-probes Measured something on the ingest side of an MCP server that I think generalises past my implementation, and I'd like a sanity check before writing it up as a proposal. Setup: a server exposes a write tool. A component in the pipeline processes untrusted page content and produces structured facts that get persisted. Injected text in that content instructs the component to emit a fact the source does not support. Four local model configurations, five runs each — 20/20 emitted the attacker's fact with confidence 1.0. The part I'd like this group's read on: every authorization check passed. The writing agent held the scope legitimately, the audit entry was valid and tamper-evident, nothing malfunctioned. Permission mediation did exactly what it was specced to do, and it is not the control that stops this. Authority and truth are different problems and the spec currently only addresses the first. Two questions: Has content-origin propagation through tool results been considered? I went through the discussions and found the Agent Identity and Delegation thread, which is adjacent but about who called, not where the content came from. I may have missed prior art. Is "provenance recorded at write time, surfaced at read time" the right shape, or does it just relocate the trust decision to whoever consumes the fact later? Happy to bring this to an Office Hours as a deployment report if that's the right slot. Probe source and raw results are public and reproducible — I'll link on request rather than dropping it here.

I'm a Research Engineer at a YC startup, and we ship features pretty fast. I usually run Claude Code, Cursor, Codex, and OpenCode in parallel, developing multiple features, one at a time.

The problem i noticed was that my agents had no coordination, and often confused mutual work, even when working in separate worktrees. As if they had no idea the others existed

So, I built MUON, it's a local app + mcp + cli, a mutual shared brain my agents can plug into. it drives the CLIs you already have and orchestrates them together for multi-feature execution workflows.

I'm still building it. Right now I use MUON to work on MUON, which is a weird but useful dogfood loop.

If anyone wants to poke at it, contributions are welcome. The thing I'm trying to get right is a coordination graph: shared memory and context so agents actually understand what the others (and I) already decided.

OSS Repository : https://github.com/Sweetdevil144/muon
Website : https://getmuon.com/
Docs : https://docs.getmuon.com
Product Demo : https://www.youtube.com/watch?v=oab6vByr1Jg

I've always been an open-source person, so the code is public and readable. License is Polyform Noncommercial. However, there's an extra grant on top - you can use it for your own work, including your day job, on your own machines. What it doesn't cover is turning it into the company's shared brain for a whole team (Enterprise only)