A months ago, I noticed something about the way I was working. Most of my day was spent inside Cursor, Claude Code, VS Code, or a terminal. That's where I wrote code, debugged issues, and even asked AI to explain unfamiliar…

Sichere Programmierung dev.to 21.07.2026, 10:37 Uhr 4 Min. Lesezeit

↗ Quelle (dev.to)

Reagiere als Erste:r — dein Feedback zählt!

A months ago, I noticed something about the way I was working.

Most of my day was spent inside Cursor, Claude Code, VS Code, or a terminal. That's where I wrote code, debugged issues, and even asked AI to explain unfamiliar libraries.

But the moment I wanted to check whether one of our AI validators had failed, everything changed.

I'd open a browser.

Log into our dashboard.

Find the right project.

Open the validator.

Check the latest run.

Copy the error.

Then go back to my editor.

It doesn't sound like much, but when you do it 20 or 30 times a day, it gets surprisingly annoying.

Eventually I caught myself thinking:

If my AI assistant can write code, explain stack traces, and refactor functions... why can't it tell me whether my validator failed?

That question eventually led us to build an MCP server for Fixzi.ai.

The Problem Was Never the Dashboard

Our dashboard wasn't the problem.

It did exactly what it was supposed to do.

The problem was context switching.

Once you're in the middle of solving a bug, every extra tab feels like friction. You stop thinking about the problem and start thinking about navigation.

Where's the project?

Which validator was it?

Was this the latest run or yesterday's?

It's only a minute or two each time, but those minutes add up.

AI Introduced a Different Kind of Monitoring

Traditional monitoring is pretty straightforward.

Is the API responding?

Is CPU usage too high?

Did the server crash?

Those are problems we've known how to monitor for years.

AI applications introduced something different.

Imagine yesterday your model returned:

{

  "user_id": 123,

  "status": "active"

}

Nothing unusual.

Then a prompt change or model update happens, and now it returns:

{

  "userId": "123",

  "user_status": "active"

}

The API still responds.

The server is healthy.

Your uptime monitor stays green.

But somewhere downstream, something breaks because your application expected a different JSON contract.

That's not downtime.

It's schema drift.

And if you're building with LLMs, you've probably seen some version of it already.

That's Where MCP Started Making Sense

Around the same time, MCP (Model Context Protocol) started gaining traction.

The idea is refreshingly simple.

Instead of your AI assistant only answering questions from its own knowledge, it can securely connect to external tools and use them on your behalf.

That immediately made me wonder...

What if our validators weren't trapped inside a browser dashboard?

What if Cursor or Claude Code could access them directly?

So We Built It

The Fixzi MCP Server exposes the same validation tools we use through MCP.

Once it's connected, your AI assistant can do things like:

List your validators

Retrieve validator details

Run validation checks

Review previous validation history

The interesting part isn't the list of tools.

It's how you use them.

Instead of opening another tab, you can simply ask:

"Run the customer validator."

Or:

"Which monitor failed today?"

Or even:

"Why did yesterday's validation fail?"

Those feel like normal questions.

Your AI figures out the rest.

One Workflow I Ended Up Using More Than I Expected

Recently I was tweaking a prompt that generates customer information.

Normally my process would've looked something like this:

Update the prompt.

Run the application.

Open the dashboard.

Find the validator.

Run another check.

Read the failure.

Go back to the code.

Repeat.

Now it's closer to this:

"Run the customer validator."

The assistant runs the validation.

It tells me that userId doesn't match the expected user_id.

I update the prompt.

I ask it to run the check again.

Done.

It's not magic.

It's just one less interruption.

And honestly, that's what makes it useful.

The Bigger Shift

I don't think dashboards are going away.

There will always be times when you want graphs, logs, and detailed reports.

But I also think we're entering a phase where many developer tools become conversational.

few years ago we searched documentation.

Now we ask AI.

few years ago we opened dashboards.

Now we're starting to ask questions like:

"Show me everything that failed today."

That feels like a much more natural way to work.

Final Thoughts

Building AI applications has introduced a new category of problems.

Your servers can be perfectly healthy while your AI quietly changes the shape of the data your application depends on.

That's why validating structured outputs is becoming just as important as monitoring uptime.

For us, exposing those validators through MCP felt like the obvious next step.

Maybe in a few years we'll look back and wonder why we spent so much time clicking through dashboards just to answer questions an AI assistant could answer in a few seconds.

I have a feeling that's where developer tools are headed.

IR-PLAYBOOK-VULN-REMEDIATIONMEDIUM

Schritte anzeigen

SOC Incident Playbook: Vulnerability Remediation & Verification

Asset Inventory

Asset-Datenbank nach betroffenen Komponenten, Versionen und exposed Ports abfragen.

nmap -sV --script vuln -p- <target-network>

Exploit MonitoringSofort

SIEM-Regeln und IDS-Signaturen (Snort/Suricata) auf Angriffsversuche schärfen.

tail -f /var/log/suricata/fast.log | grep <cve>

Patch DeploymentSofort

Patch oder offiziellen Workaround gemäß Hersteller-Empfehlung einspielen.

Check Vendor Security Advisory Bulletin

1-Click Detection Engineering: Multi-Dialect SIEM Rules5 Formate

Regeln anzeigen

Syntax validiert (0 Fehler)

title: Detect Exploitation - I Got Tired of Opening Dashboards, So We Built an MCP Server
id: 5cb24fb6-616c-45e3-a0ba-0cfddb33a788
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

Syntax validiert (0 Fehler)

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "I Got Tired of Opening Dashboa" ascii wide
    condition:
        any of them
}

Syntax validiert (0 Fehler)

index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("I Got Tired of Opening Dashboards So We ")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Syntax validiert (0 Fehler)

message: "*I Got Tired of Opening Dashboards So We *"

Syntax validiert (0 Fehler)

CommonSecurityLog
| where Message has "I Got Tired of Opening Dashboards So We "
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

🎯

MITRE ATT&CK Matrix Navigator 14 Taktiken

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

💡 Tipp: Klicken Sie auf eine TTP, um Gegenmaßnahmen und SIEM-Erkennungsregeln anzuzeigen.Enterprise Matrix v14.1

🚀 Auf tsecurity.de entdecken

◀ VORHERIGER BEITRAG 1 Min

Selbst dunkle Bereiche erstrahlen mit dieser Lidl-Lampe in hellem Licht

IT Nachrichten

NÄCHSTER BEITRAG 4 Min

The Math Behind a Late-Fee: Turning "Net 30" Into an Enforceable Number

Sichere ProgrammierungWeiterlesen ▶

Blättern: Pfeiltasten [ ← ] [ → ] · Tasten j / k · mobil: Wischen

Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich I Got Tired of Opening Dashboards, So We.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen

1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.

🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC

Schnell-Prompts für Analysten

⚠️ DEFANGED SANDBOX VIEW (tsecurity.de): Alle Netzwerkindikatoren und URLs wurden neutralisiert (2 Indikatoren entschärft). Nur zur defensiven Analyse!

Format: python

#!/usr/bin/env python3
# Exploit Title: PoC for Target
import socket, sys
target = '192[.]168[.]1[.]10'
url = 'hxxp://target[.]local/vuln'
s = socket.socket()
s.connect((target, 80))
s.send(b'GET / HTTP/1.1\r\nHost: target.local\r\n\r\n')