DEV Community

Kiell Tampubolon profile picture

Kiell Tampubolon

Security Engineer & Technical Writer | AI Security, MCP, Developer Security & Automation

Location Singapore Joined Joined on  Personal website https://www.kielltampubolon.id/ github website
June Solstice Game Jam Completion
GitHub Copilot "Finish-Up-A-Thon" Challenge Completion
Gemma 4 Challenge Completion
2 Week Community Wellness Streak
Google Cloud NEXT Writing Challenge Completion Badge
OpenClaw Challenge Completion Badge
1 Week Community Wellness Streak
Writing Debut
A fake MCP server spent three months earning trust. The tells were there

A fake MCP server spent three months earning trust. The tells were there

Comments 3
2 min read

Want to connect with Kiell Tampubolon?

Create an account to connect with Kiell Tampubolon. You can also sign in below to proceed if you already have an account.

Already have an account? Sign in
How to Audit an MCP Server Manifest for Prompt Injection in Tool Descriptions

How to Audit an MCP Server Manifest for Prompt Injection in Tool Descriptions

Comments
5 min read
How to Build an AI SOC With Tools You Already Own (Copilot Studio, Power Automate, Graph API)

How to Build an AI SOC With Tools You Already Own (Copilot Studio, Power Automate, Graph API)

2
Comments 1
5 min read
What Is MCP Security? Common Attacks and How to Scan Your MCP Servers

What Is MCP Security? Common Attacks and How to Scan Your MCP Servers

Comments 3
5 min read
200,000 exposed MCP servers later, the boring checks still win

200,000 exposed MCP servers later, the boring checks still win

Comments
2 min read
Your error tracker is an input channel now

Your error tracker is an input channel now

Comments
2 min read
My Scanner Passed Until I Built a Harness That Lied to It on Purpose

My Scanner Passed Until I Built a Harness That Lied to It on Purpose

Comments 1
3 min read
The NSA published 17 pages on MCP security. Here it is as a checklist you can run today

The NSA published 17 pages on MCP security. Here it is as a checklist you can run today

Comments
3 min read
My Scanner Passed Until I Built a Harness That Lied to It on Purpose

My Scanner Passed Until I Built a Harness That Lied to It on Purpose

2
Comments 6
3 min read
Bayaran Sudah Masuk tapi Status Masih Belum Dibayar: Kenapa Webhook Pembayaran Gagal Diam-diam

Bayaran Sudah Masuk tapi Status Masih Belum Dibayar: Kenapa Webhook Pembayaran Gagal Diam-diam

Comments 1
4 min read
Benchmarking My MCP Security Scanner: 14 of 14 Findings, Zero False Positives

Benchmarking My MCP Security Scanner: 14 of 14 Findings, Zero False Positives

Comments 1
2 min read
Two Agents, One Protocol: My First A2A Test, Including Every Bug on the Way

Two Agents, One Protocol: My First A2A Test, Including Every Bug on the Way

Comments 5
3 min read
Three PRs to Rowboat in 24 Hours, One of Them Taught Me More Than the Others

Highlights the orientation cost of agentic coding

Three PRs to Rowboat in 24 Hours, One of Them Taught Me More Than the Others

3
Comments 9
3 min read
A happy-path MCP demo proves almost nothing about tenant isolation

A happy-path MCP demo proves almost nothing about tenant isolation

Comments 8
3 min read
What actually changes when an MCP server leaves your laptop

What actually changes when an MCP server leaves your laptop

Comments 1
3 min read
A valid payment webhook can still be dangerous to process twice

A valid payment webhook can still be dangerous to process twice

Comments 1
4 min read
MCP 2026-07-28 Went Stateless: A Planted Prompt Is a Credential

MCP 2026-07-28 Went Stateless: A Planted Prompt Is a Credential

Comments 1
8 min read
2 CVSS 9.8 Agent Sandbox CVEs Landed the Same Day

2 CVSS 9.8 Agent Sandbox CVEs Landed the Same Day

Comments
6 min read
The Cursor Allowlist Bypass That Starts With a File Named curl

The Cursor Allowlist Bypass That Starts With a File Named curl

Comments 3
4 min read
My MCP Security Scanner Missed 2026's Worst MCP RCE: Here Is the One-Rule Fix

My MCP Security Scanner Missed 2026's Worst MCP RCE: Here Is the One-Rule Fix

1
Comments 4
5 min read
Two ways to reuse a privileged CI token (and my rule only caught one)

Two ways to reuse a privileged CI token (and my rule only caught one)

1
Comments 2
5 min read
We Planted 10 Vulnerabilities to Test Free Semgrep. It Reported 3.

Understanding where free security tools stop

We Planted 10 Vulnerabilities to Test Free Semgrep. It Reported 3.

6
Comments 5
6 min read
Asynchronous Telemetry Blindness in AI Streaming Clients: A PoC Where Text Renders, Billing Stays at Zero

Asynchronous Telemetry Blindness in AI Streaming Clients: A PoC Where Text Renders, Billing Stays at Zero

1
Comments 1
7 min read
Your AI agent is the most over-privileged account you own

Your AI agent is the most over-privileged account you own

1
Comments
4 min read
The MCP attack your code review cannot see

The MCP attack your code review cannot see

Comments 2
4 min read
Di era AI, yang menang bukan yang kerja paling banyak

Di era AI, yang menang bukan yang kerja paling banyak

Comments
3 min read
Connecting Sophos Central to a Copilot Studio Agent with Power Automate

Connecting Sophos Central to a Copilot Studio Agent with Power Automate

Comments
4 min read
I gave Claude a memory of everything I browse — here's the architecture

I gave Claude a memory of everything I browse — here's the architecture

3
Comments 7
3 min read
We thought we had location-based MFA. We had something else entirely

We thought we had location-based MFA. We had something else entirely

1
Comments 3
5 min read
Solstice — A Game About Holding the Light

June Solstice Game Jam Submission

Solstice — A Game About Holding the Light

2
Comments
3 min read
Finishing a Read-Only MCP Server: From 6 Tools to 9

Finishing a Read-Only MCP Server: From 6 Tools to 9

5
Comments 2
3 min read
Claude Token Monitor 🚀 — Real-Time Claude Usage HUD for Your Windows Desktop

Claude Token Monitor 🚀 — Real-Time Claude Usage HUD for Your Windows Desktop

Comments
3 min read
AI Agents: The Future of Autonomous Intelligence

AI Agents: The Future of Autonomous Intelligence

1
Comments 2
3 min read
I Built a Kubernetes Alternative. It Changed My Perspective on Complexity.

I Built a Kubernetes Alternative. It Changed My Perspective on Complexity.

Comments
2 min read
I Dumped My Entire Codebase into Gemma 4. It Found a Bug My Team Missed for 3 Months.

Gemma 4 Challenge: Write about Gemma 4 Submission

I Dumped My Entire Codebase into Gemma 4. It Found a Bug My Team Missed for 3 Months.

2
Comments
5 min read
I Was Wrong About AI. Here Is the Moment That Changed It.

I Was Wrong About AI. Here Is the Moment That Changed It.

Comments
3 min read
I Struggled with Data Analysis. Claude for Excel Changed Everything.

I Struggled with Data Analysis. Claude for Excel Changed Everything.

Comments
3 min read
I Struggled with a Bug for Days — Here's What I Learned About Clean Code and Debugging

I Struggled with a Bug for Days — Here's What I Learned About Clean Code and Debugging

Comments
4 min read
I Deployed My First Cloudflare Worker — Here's What I Learned

I Deployed My First Cloudflare Worker — Here's What I Learned

Comments
3 min read
I Thought I Understood State Management in React. Then a Memory Leak Happened.

I Thought I Understood State Management in React. Then a Memory Leak Happened.

Comments
4 min read
I Tidied Up Hundreds of Open Tabs with Notion Web Clipper — Here's What I Found

I Tidied Up Hundreds of Open Tabs with Notion Web Clipper — Here's What I Found

Comments
3 min read
The Surprising Power of Code Reviews: Pull Requests That Saved My Project

The Surprising Power of Code Reviews: Pull Requests That Saved My Project

Comments
4 min read
I Shipped My First Cloudflare Worker via GitHub Actions in 47 Minutes (3 Were Wasted on the Wrong API Token)

I Shipped My First Cloudflare Worker via GitHub Actions in 47 Minutes (3 Were Wasted on the Wrong API Token)

1
Comments
4 min read
I Connected 11 MCP Servers. 3 of Them Actually Did Anything.

I Connected 11 MCP Servers. 3 of Them Actually Did Anything.

Comments 2
4 min read
I Built an OSINT Aggregator That Queries 5 Threat Intel Sources in One Command

I Built an OSINT Aggregator That Queries 5 Threat Intel Sources in One Command

Comments
4 min read
I Let Claude Pentest My Own Side Project for $0.43. It Found Three Things in 12 Minutes.

I Let Claude Pentest My Own Side Project for $0.43. It Found Three Things in 12 Minutes.

Comments
6 min read
I Let OpenClaw Run My Mornings for 7 Days. It Stopped Acting Like a Chatbot on Day 4.

OpenClaw Challenge Submission 🦞

I Let OpenClaw Run My Mornings for 7 Days. It Stopped Acting Like a Chatbot on Day 4.

3
Comments
3 min read
What's New in GKE at Next '26: Kubernetes Just Got Smarter (and Cheaper)

Google Cloud NEXT '26 Challenge Submission

What's New in GKE at Next '26: Kubernetes Just Got Smarter (and Cheaper)

8
Comments
5 min read
Building Secure PDF Automation in .NET: The Trade-offs Nobody Talks About

Building Secure PDF Automation in .NET: The Trade-offs Nobody Talks About

2
Comments
6 min read
loading...