I find and fix the security bugs in the plumbing that lets AI agents use tools.
Credited in 4 CVEs (Google · Rapid7 · AWS ×2) · 17 published security advisories · named on the security recognition pages of JPMorgan Chase, Weaviate, and Amazon Web Services · featured by Ars Technica · speaking at Black Hat Europe 2026
📍 Chicago → London (Dec 2026) · 📧 [email protected] · 🔗 cognivators.com · advisory list · research
Open to: security research roles · MCP/agentic-security consulting · contract pentesting
| CVE | Vendor | The bug | Severity |
|---|---|---|---|
| CVE-2026-14540 | Google — MCP Toolbox for Databases | SSRF via unrestricted HTTP redirection — crafted path parameter made the server follow redirects to internal endpoints | 8.0 High |
| CVE-2026-125271 | AWS — aws-api-mcp-server | Security policy bypass: broken kebab-case normalization silently defeated the denyList for 509 AWS operations — IAM federation, MFA, SSH keys | High |
| CVE-2026-116635 | AWS — aws-serverless-mcp-server | Path traversal via unvalidated project_name — read/write .json outside the deployment-status directory |
Moderate |
| CVE-2026-97228 | Rapid7 — Bulk Export MCP | GraphQL query injection in the export status lookup | Low |
Selected — full list of all 17 →
| Recognition | Where I'm named |
|---|---|
| Datalayer · Jupyter MCP Server | Critical advisory, credited reporter |
| 1Password-MCP (community) | High advisory, credited finder |
| JPMorgan Chase | Public Recognition for Responsible Disclosures list |
| Weaviate | Security Hall of Fame — SSRF, Aug 2026 |
| Amazon Web Services | Security bulletins 2026-164 & 2026-176 — named thanks |
| Uber · Composio · DoiT · Timescale | Merged security fixes, credited by name in the PR |
| NAV Norway (GHSA-7hwf-488h-59x8, joint) · France data.gouv.fr · Tangerang, Indonesia (Wazuh-MCP GHSA) | Government fixes crediting me by name |
- GitHub's official MCP server #3056 (Go) — bearer token attaches only to configured GitHub hosts
- MongoDB's official MCP server #1501 (TypeScript) — connection-string secret redaction
- salesforce-mcp-server #16 — command-injection escaping
🛡️ The engine: mcp-safeguard — every CVE above was found with it
pip install mcp-safeguard && mcp-safeguard scan your-config.jsonOpen-source static-analysis security scanner for MCP servers — the standard connecting AI agents (Claude, Cursor, GPT) to tools, files, and APIs. 148 rules, 7 categories (prompt injection · credential exposure · SSRF · tool poisoning · endpoint exposure · OAuth scope · source audit), each finding with severity, CVSS, and a fix. 252 tests · CI on 3.11–3.13 · official MCP registry listing · runs as CLI, in CI, or as an MCP server itself. Findings from it have been confirmed and fixed by Google, GitHub, Rapid7, AWS, JPMorgan Chase, and Weaviate.
- Never Emitted — reporter attribution lost in GitHub's machine-readable CVE/OSV/NVD records (0/238, 0/302, 0/43) → arXiv 2609.33099 · Zenodo DOI · CC0 replication dataset
- Protocol Pivoting — cross-protocol attack escalation in agentic AI (MCP → A2A/ANP) → Zenodo DOI
- IETF Internet-Draft — Security Considerations for MCP → datatracker
- 🎤 MCPCon North America (Linux Foundation), San Jose — Oct 2026 · 🔥 Black Hat Europe 2026 Arsenal, London — Dec 2026 (upcoming)
- 📰 Ars Technica · The Next Web · Unite.AI · AI.info · timesof.ai · MCP Store
Through Cognivators:
- MCP server security review — fixed scope, report + retest
- AI agent attack-surface assessment — trust boundaries, tool poisoning, protocol-level risk
- Advisory on shipping agent infrastructure safely
Coordinated disclosure only — every finding above was reported privately, fixed, then published. Vulnerability in something of mine? [email protected] · PGP · disclosure policy