whoami
Syed Anas Mohiuddin
AI security researcher · Model Context Protocol · founder, Cognivators
I research security in the Model Context Protocol ecosystem, the emerging standard connecting AI agents to tools, data, and each other. I discovered and reported CVE-2026-14540, a Server-Side Request Forgery vulnerability in Google's MCP Toolbox for Databases, assigned by Google as the CVE Numbering Authority. Since 2026 I've run a coordinated responsible-disclosure effort across MCP servers built by companies throughout the ecosystem, working through GitHub Security Advisories and direct vendor contact, several currently in vendor triage. I maintain mcp-safeguard, an open-source scanner that checks MCP servers for prompt injection, credential exposure, SSRF, and tool-poisoning risks, and contribute to community efforts tracking MCP-related CVEs. Outside of security research, I founded Cognivators, an AI automation studio.
Verified work
Research & writing
Community contributions
FAQ
Who is Syed Anas Mohiuddin?
An AI security researcher focused on Model Context Protocol (MCP) security. I discovered CVE-2026-14540 in Google's MCP Toolbox for Databases, maintain the open-source scanner mcp-safeguard, and founded Cognivators, an AI automation studio.
What is CVE-2026-14540?
A Server-Side Request Forgery (SSRF) vulnerability in Google's MCP Toolbox for Databases. Assigned by Google as CNA with a CVSS v4.0 score of 8.0 (High), published 2026-07-31, crediting me as finder.
What is mcp-safeguard?
An open-source static-analysis scanner for MCP servers, published on PyPI, checking for prompt injection, credential exposure, SSRF, and tool-poisoning risks across 148 rules.
What is the Model Context Protocol?
A standard that lets AI agents and LLMs connect to external tools, data sources, and other agents. Because it grants AI systems the ability to take real actions, its security is an active research area, including the disclosure work described above.