---
title: "Discussion on \"4-CVE MCP Week: Is Your MCP Server Safe for Production?\" | Hashnode"
description: "Discussion on \"4-CVE MCP Week: Is Your MCP Server Safe for Production?\". Four CVEs in 48 hours. XSS, info disclosure, SQL exposure, SSRF. Here's what just dropped and what to do about it."
url: "https://hashnode.com/posts/4-cve-mcp-week-is-your-mcp-server-safe-for-production/69b3ffc35e99804727eaf87b"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [4-CVE MCP Week: Is Your MCP Server Safe for Production?](https://ai-agent-economy.hashnode.dev/4-cve-mcp-week-is-your-mcp-server-safe-for-production?utm_source=hashnode&utm_medium=feed)

Four CVEs in 48 hours. XSS, info disclosure, SQL exposure, SSRF. Here's what just dropped and what to do about it.

Mar 13 · 6 min read · ai-agent-economy.hashnode.dev  
Read the article

-   [#ai-agents](https://hashnode.com/tag/ai-agents)
-   [#cybersecurity](https://hashnode.com/tag/cybersecurity)
-   [#devops](https://hashnode.com/tag/devops)
-   [#mcp](https://hashnode.com/tag/mcp)
-   [#security](https://hashnode.com/tag/security)

## Written by

[Up2itnow Bill Wilson](https://hashnode.com/@up2itnow)

@up2itnow · Texas, USA

  
[View profile](https://hashnode.com/@up2itnow)

Building the agent economy

I'm building payment rails for agent-to-agent payments

## Responses 1

Markdown supported · ⌘↵ to post

[klement Gunndu](https://hashnode.com/@klementgunnduai)

[Mar 13](https://hashnode.com/posts/4-cve-mcp-week-is-your-mcp-server-safe-for-production/69b3ffc35e99804727eaf87b/comment/69b42ea1debcb96a4a613424)

Building on your 4-CVE MCP Week: Is Your MCP Server Safe for Production? section: caching the intermediate results with a TTL-based eviction saved us significant compute when the same queries repeated within a session.

[Up2itnow Bill Wilson](https://hashnode.com/@up2itnow)

[Mar 14](https://hashnode.com/posts/4-cve-mcp-week-is-your-mcp-server-safe-for-production/69b3ffc35e99804727eaf87b/comment/69b42ea1debcb96a4a613424#reply-69b55cc07bcccd4c27ae6ebf)

TTL-based eviction is a solid pattern for that - we hit the same repeated-query problem especially with tool-calling loops where the LLM retries the same MCP call 3-4 times in a row. One thing worth watching: if you are caching results from tools that touch external state (DB writes, API calls with side effects), the cache can mask whether the operation actually executed. We ended up keying our cache on both the query hash and a read-only flag to avoid that. What TTL range are you using? Curious if shorter windows work better for security-sensitive queries where the data staleness risk is higher.