{
  "id": 1162006,
  "title": "I shipped an MCP server that reported success without signing anything",
  "url": "https://urgent.news/2026/08/16/i-shipped-an-mcp-server-that-reported-success-without-signing-anything",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-16T00:30:27.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/edycutjong/i-shipped-an-mcp-server-that-reported-success-without-signing-anything-6oh"
  },
  "original_language": "en",
  "account": "An MCP server was created to enable an AI assistant to trade tokens and claim creator fees on the Solana blockchain. However, a bug was discovered where the assistant would report success without signing or submitting any transactions. Despite having 337 tests that all passed, the issue went unnoticed for three months. This bug highlights a fundamental problem with giving a model a signing key, as it allows the model to initiate a spend without any safeguards in place. The solution to this problem involves structuring the transaction flow such that signing occurs after the transaction has been simulated and confirmed, preventing any funds from being moved without proper authorization.",
  "summary": "I built an MCP server that lets an AI assistant trade tokens and claim creator fees on Solana. Then I shipped a version where the two write tools built transactions, discarded them, and returned success. Nothing was ever signed. Nothing was ever submitted. It had 337 tests. All of them passed. I didn't find out for three months. This post is about what that bug taught me, and the design it…",
  "key_points": [
    "AI assistant reported success without signing transactions",
    "Bug remained unnoticed for three months despite 337 tests",
    "Solution requires proper structuring of transaction flow"
  ],
  "editors_take": "The discovery of the bug in the MCP server highlights a need to restructure transaction flows to require signing after simulation and confirmation to prevent unauthorized spending.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}