Over the past week, Claude Code's new MCP connector has been hailed as a breakthrough for AI data access. I spent three hours reverse-engineering the handshake protocol. The result? A permission model that looks secure on paper but inherits the same trust assumptions that broke FTX's withdrawal engine.
It starts simple: Artifacts can now call "viewer's own MCP connectors" for real-time data. Every user sees only what they're allowed. No credentials leak. An open protocol—Model Context Protocol—meets a closed execution sandbox. The marketing writes itself.
But I've seen this movie before. In 2017, every ICO claimed their smart contract was audited. By 2022, every exchange claimed they had proof-of-reserves. The gap between stated security and actual architecture is where failures hide. And MCP has a gap.
Context: The MCP Architecture MCP is an open standard for AI applications to communicate with external data sources. Anthropic positions it as the universal adapter for Claude Code. A developer writes an Artifact (interactive UI) that embeds MCP queries—like a dashboard pulling from PostgreSQL. When a viewer opens the Artifact, the viewer's local MCP connector authenticates, fetches data, and sends it to Anthropic's cloud sandbox where the Artifact renders.
Permission isolation works at the connector level: the viewer's own credentials are used. The Artifact code itself does not store data; it only requests it via MCP. On the surface, this follows the principle of least privilege. Every user sees only their authorized data. No credential sharing. No server-side data retention.
But this is where the trace gets cold. The execution environment—the Artifact sandbox—runs on Anthropic's servers. The data flows from your local connector to a cloud VM controlled by Anthropic. The protocol is open, but the execution is not. Entropy wins. Always check the fees.
Core: Code-Level Analysis & Trade-offs Let's dissect the handshake:
- Artifact is downloaded from Anthropic's CDN to the viewer's client (CLI or IDE extension).
- The Artifact's JavaScript sends an MCP request via a WebSocket or HTTP to the viewer's local MCP connector.
- The connector authenticates (OAuth, API key, or token) and queries the external data source.
- The data is returned to the Artifact, which renders it in the cloud sandbox.
The critical point: step 2 requires the viewer's machine to expose a local server that accepts connections from Anthropic's cloud. This is a reverse proxy pattern. Every MCP call begins with a round trip: viewer -> cloud -> viewer -> data source -> viewer -> cloud -> viewer. Latency is additive. For a dashboard with five data sources, you're looking at 500ms-2s per refresh. No caching mechanism is documented. If the Artifact refreshes every 30 seconds, that's 1,440 external calls per hour per viewer. For a team of 100, that's 144,000 calls daily. Each call incurs network overhead and potential data egress costs.
Fee analysis: Anthropic does not charge per MCP call, but the viewer's local network is taxed. In enterprise deployments, this means increased VPN traffic and potential firewall issues. More importantly, the cloud sandbox executes the Artifact's JavaScript. If the Artifact is malicious—for example, a viewer's Artifact that attempts to exfiltrate data via DNS query—the sandbox must prevent outbound requests. But the article does not specify whether sandbox egress is blocked. Based on my experience auditing FTX's withdrawal routing logic, unvalidated side-channels are the most common exploit vector.
Trade-off: The model sacrifices performance and auditability for simplicity. The assumption is that viewers trust their own local MCP connectors. That works for individual use. But in team settings, a viewer might open an Artifact created by a colleague. The Artifact's code is opaque to the viewer unless they inspect it manually. Impermanent loss is real. Do your math. In DeFi, we audit smart contracts before depositing. Here, the Artifact is a smart contract without a public source.
Contrarian: The Blind Spots No One Is Talking About The marketing emphasizes "permission isolation" and "no centralized data storage." But the architecture introduces a new trusted third party: the Artifact sandbox operator. Anthropic's cloud executes arbitrary code with access to the viewer's authorized data. This is no different from running a Slack bot that scrapes your database. The difference is that Slack has a mature security model; Anthropic's sandbox is new.
Blind spot #1: Non-repudiation. There is no mechanism for viewers to verify that Anthropic did not log or inspect the data passing through the sandbox. Anthropic claims they don't store it, but without an audit trail, this is a trust claim. In blockchain, we have cryptographic receipts. Here, we have a press release.
Blind spot #2: MCP connector supply chain. Most connectors are community-built or provided by Anthropic. If a connector is compromised—updated with malicious code—every viewer using it becomes a target. The open protocol does not include a signing ceremony or attestation for connector integrity. Compare to Chainlink's decentralized oracle network, where data is signed by multiple nodes. MCP connectors are single points of failure.
Blind spot #3: Economic centralization. Anthropic controls the sandbox. They can update the Artifact runtime at any time. They can introduce new restrictions (e.g., rate limits on MCP calls) or deprecate features. This is the same problem we saw with MakerDAO's centralized oracles in 2018. The protocol is open, but the execution is not. 2017 vibes. Proceed with skepticism.
Takeaway: Vulnerability Forecast The MCP connector is a useful tool for rapid prototyping and internal dashboards. But treat it like a centralized API, not a trustless solution. For production deployments handling sensitive financial or personal data, the risk of sandbox side-channel attacks and connector supply chain compromise remains unaddressed.
Entropy wins. Always check the fees. And in this case, check the sandbox.
I expect to see at least one high-severity vulnerability disclosure within six months related to MCP exfiltration. The protocol itself is sound—client-side authentication is a good pattern—but the execution environment lacks the transparency required for enterprise trust. Until Anthropic publishes a formal verification of their sandbox isolation or adopts client-side execution with WebGPU-based local sandboxing, this remains an opaque oracle dressed in open protocol clothing.