The why

It has been five years since I started working, and a lot has changed around me. When I started I was a software engineer with nothing beyond a couple of internships. Five years later I have built up cybersecurity experience at Microsoft, distributed payments infrastructure at AWS, product and financial processing skills at Stripe, and product bootstrapping plus clean energy finance at Crux. That leaves me with one question as AI reshapes my job, my passion, and my craft. I think my past gives me a niche: combining security and finance to help protect the data and financial systems that matter most.

Where do I start

So where do I start? This was the hardest part to answer. I debated it for a while and spent time building apps to see if I could take one somewhere, but it is hard to find problems when you have no customers. So I decided to flip the whole thing around.

The plan

Instead I am going to pick various AI tools, starting with MCP servers, and look for vulnerabilities in them. For each one I will do a design analysis: how it is implemented, what its threat model looks like, how its customers are structured, what the pros and cons are, and finally any recommendations or vulnerabilities I find. This will be done transparently. I do not plan to run any penetration testing without written approval, so this is purely a research project from my end.

Finding a place to begin

Where do you find an MCP server to start? GitHub is where code lives, so that is where I went to look for open source projects.

From there I started looking at things that sounded cool to me. Graph based tools have always fascinated me. I only ever learned to implement graphs in small setups and in all the LeetCode I grinded, so seeing them at real scale is exciting. That led me to code graph agents, and I ran across GitNexus. It has a lot of stars and seems to be in active development. They also publish an open security policy, so if I do find something, reporting it is straightforward and I stay out of trouble.

Why GitNexus is interesting from a security perspective

A few things stood out to me right away:

• It ingests untrusted repositories and generates AGENTS.md and CLAUDE.md context files, plus agent skills, from what it finds. That is a direct indirect prompt injection path, where content in an indexed repo can shape text the agent later reads as instructions. That alone is a post.
• It registers Claude Code PreToolUse and PostToolUse hooks that enrich grep, glob, and bash calls and auto reindex after commits. Hooks executing around bash calls are worth reading carefully.
• Cypher graph queries are exposed as an MCP tool against KuzuDB. That is a query construction question, the same shape as SQL injection.
• It handles GitHub PATs for cloning private repos, and it writes global MCP config files during setup.
• gitnexus mcp --http exposes a Streamable HTTP server with legacy SSE. I want to check what auth it has, if any, and what it binds to. Between 38 and 40 percent of scanned servers had none.
• gitnexus wiki feeds repo content to an LLM.

What’s next

Now that I have GitNexus, I will post an update on it by 9/13/2026. Stay tuned 🙂 ❤️

---