Gephyr

Your MCP hub. Your app, inside every Agent.

[Gephyr @Gephyrai]

Every agent should be able to use any app. That's our North Star.

Today we're launching Gephyr, your one-stop MCP hub. Connect your app once and your users can use it from Claude, ChatGPT, Grok Bot, Cursor and more. No code needed. 🧵

[Gephyr @Gephyrai]

Signing in to an MCP server was enough to get your machine taken over.

Pillar Security found a flaw in OpenCode on Windows and WSL.

When you signed in to a remote MCP server, the server told OpenCode where to send your browser. OpenCode passed that link to PowerShell without escaping it. So a server could hide a command inside an ordinary-looking https link, and it ran with your permissions.
The server didn't need to start out malicious. One that's taken over later, or a domain that changes hands, works just as well.

If you use OpenCode on Windows or WSL, update to 1.18.33 or later. No CVE was issued, so scanners won't flag older builds.

The bigger lesson: an MCP server isn't just a list of actions. It takes part in sign-in, it decides where your browser goes, and it sees what you send it. Connecting one is a trust decision.

That's how we built Gephyr:

•A company has to prove it owns its domain and its login before its connector goes live.

•Every sign-in link our connectors hand out is built on https://t.co/l4iVoCSl3L, never from text a customer typed.

•Payments, cancellations and other risky actions can ask the user first, every time.

•The AI app never gets your login. People sign in on the app's own page. The AI app gets a pass that only works for that one connector, and Gephyr keeps the real key to the app's API encrypted.

•Gephyr never runs anyone's code. A connector is settings only: which endpoints, which inputs. So a connector can't carry the kind of attack that hit OpenCode.

•It only talks to the app's own API. Calls go to the company's own addresses only, over https, and redirects aren't followed. A connector can't be turned against other sites.

•Gephyr guards against hidden instructions. Text written by other people, like messages or reviews, is marked so agents treat it as content, not orders. Hidden characters and known attack phrases are stripped or blocked before a connector goes live.

Read more about how we deal with MCP security: https://t.co/e2VKALu0Oo

[The Hacker News @TheHackersNews]

🚨 OpenCode flaw lets malicious MCP servers execute code on Windows and WSL when developers initiate sign-in.

Fixed in v1.18.33, but there's no CVE or security advisory. Vulnerability scanners won't flag affected versions.

What developers need to know: https://t.co/l6N4LCjhWt

[Gephyr @Gephyrai]

Your API works for developers. Agents are less forgiving.

We turned three public APIs into connectors and used them in real AI apps. Here are 8 things that broke, from hidden rules to vague errors, and how to fix each one.

https://t.co/x9y4S0wEuC

[Gephyr @Gephyrai]

Building an app? Put it inside the AI apps your users already use.

You can customise your connector, from the actions to the setup page. Free to build, from $9.99 a month when you go live.

Every agent, any app. Start yours: https://t.co/SdaUGGtrKB

[Gephyr @Gephyrai]

Every agent should be able to use any app. That's our North Star.

Today we're launching Gephyr, your one-stop MCP hub. Connect your app once and your users can use it from Claude, ChatGPT, Grok Bot, Cursor and more. No code needed. 🧵

[Gephyr @Gephyrai]

Got paying subscribers? Give them something extra.

You can make your connector, or just some of its actions, available only on your paid plans. AI access becomes one more reason to upgrade.