What attackers have tried against our own apps, and what we built in response. Written by the founders of Bowshock.
One attacker spent three days probing our MCP connector with SSRF, cross-tenant reads and forged JWTs. Every attempt was denied. Here is what they tried.
