Skip to content
View CorsenAI's full-sized avatar
8 followers · 0 following

Achievements

Achievement: StarstruckAchievement: QuickdrawAchievement: Pull Sharkx2

Achievements

Achievement: StarstruckAchievement: QuickdrawAchievement: Pull Sharkx2

Highlights

Block or report CorsenAI

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. Markdown is supported. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
CorsenAI/README.md

Mordehai Attia

Founder of Corsen AI — endpoint security for AI agents and MCP.

Security research

Independent research on MCP servers and the open source they build on, reported to the maintainers first.

  • AWS Labs postgres-mcp-server — read-only mode bypass leading to OS command execution, CVE-2026-87911 (critical, fixed in 1.1.7; credited together with Ryan von Brubeck)
  • mcp-atlassian — project and space filter bypass letting an MCP agent read data outside its scope, CVE-2026-77251 (fixed in 0.22.0)
  • Google mcp-toolbox — missing OAuth audience check in non-MCP mode, fix under review (PR #3676)
  • Upstream bug reports: Cloudflare Pingora #979 (accepted), Hugging Face huggingface_hub #4749 (fixed in v1.31.0, credited in the fix)

Pinned Loading

  1. hermes-connector hermes-connector Public

    Chrome browser extension for Hermes Agent — exact sessions, user-selected tabs, and local-first browser control.

    Python 26 4

  2. hermes-windows-runtime-skills hermes-windows-runtime-skills Public

    Hermes Agent skills for deterministic path routing and non-installing Python runtime selection across Windows, Git Bash/MSYS, and WSL.

    PowerShell 3 2

  3. corsen-context corsen-context Public

    Owner-controlled public content for MCP and WebMCP: four read-only tools from one manifest, a native WordPress plugin, Next.js and Astro adapters, Express and static references, and five CMS bridges.

    PHP 2 1

  4. corsen-context-netlify corsen-context-netlify Public template

    One-click Netlify template for static content, llms.txt, MCP and WebMCP.

    JavaScript

  5. corsen-context-shopify-native corsen-context-shopify-native Public

    Read-only verifier for Shopify WebMCP, Storefront MCP and UCP surfaces.

    JavaScript

  6. corsen-context-wordpress corsen-context-wordpress Public

    Installable WordPress integration for llms.txt, MCP and owner-controlled WebMCP.

    PHP