Introduction

As developers, we are increasingly integrating AI into our workflows using IDEs like Cursor, Windsurf, or Claude Desktop. However, Large Language Models (LLMs) can sometimes struggle with precise mathematical conversions or lack access to specific local logic.

This is where the Model Context Protocol (MCP) shines. Think of MCP as a standardized “USB-C port” that connects AI models to your local tools and data.

In this tutorial, I will show you how to build a Unit Converter MCP Server from scratch using Python. This tool will allow your AI agent to perform precise conversions for temperature, length, and weight without “hallucinating” the numbers.

Prerequisites

Python 3.10+ installed.

A code editor (VS Code, Cursor, etc.).

Basic command line knowledge.

Step 1: Environment Setup

First, let’s create a directory for our project and set up a clean Python environment.

Open your terminal and run:

mkdir mcp-unit-converter
cd mcp-unit-converter

2. Create a virtual environment

python -m venv venv

3. Activate the environment

On Windows:

venvScriptsactivate

On Mac/Linux:

source venv/bin/activate

4. Install the MCP SDK

pip install mcp[cli]

Step 2: Writing the Server Code

We will use the FastMCP class to build our server quickly. Create a file named converter.py.

This code defines tools for converting Temperature (Celsius/Fahrenheit), Length (Meters/Feet), and Weight (Kg/Pounds). from mcp.server.fastmcp import FastMCP # Initialize the server mcp = FastMCP("UnitConverter") # --- Temperature Tools --- @mcp.tool() def celsius_to_fahrenheit(celsius: float) -> float: """Convert Celsius to Fahrenheit""" return (celsius * 9/5) + 32 @mcp.tool() def fahrenheit_to_celsius(fahrenheit: float) -> float: """Convert Fahrenheit to Celsius""" return (fahrenheit - 32) * 5/9 # --- Length Tools --- @mcp.tool() def meters_to_feet(meters: float) -> float: """Convert Meters to Feet""" return meters * 3.28084 @mcp.tool() def feet_to_meters(feet: float) -> float: """Convert Feet to Meters""" return feet / 3.28084 # --- Weight Tools --- @mcp.tool() def kg_to_pounds(kg: float) -> float: """Convert Kilograms to Pounds""" return kg * 2.20462 @mcp.tool() def pounds_to_kg(pounds: float) -> float: """Convert Pounds to Kilograms""" return pounds / 2.20462 if __name__ == "__main__": mcp.run(transport="stdio") 

Step 3: Testing with MCP Inspector

Before connecting it to an AI, let’s verify it works locally using the MCP Inspector.

Run this command in your terminal:

mcp dev converter.py

This will open a local web interface. You can select the celsius_to_fahrenheit tool, input 0, and check if it returns 32.

Step 4: Connecting to Cursor (AI Client)

Now for the magic. We will connect our server to Cursor (or any MCP-compliant client).

Create a .cursor folder in your project (optional, but good for organization).

Create or edit your mcp.json configuration file (usually located in your global Cursor settings or project root).

Add the following configuration:

{
“mcpServers”: {
“unit_converter”: {
“command”: “/ABSOLUTE/PATH/TO/YOUR/venv/bin/python”,
“args”: [“/ABSOLUTE/PATH/TO/YOUR/converter.py”]
}
}
}

⚠️ Important: You must use the absolute path to your python executable inside the venv folder and the absolute path to your converter.py file.

Step 5: Seeing it in Action

Once connected, you can open your AI Chat and ask:

“I have a shipping crate that weighs 450 kg and is 12 meters long. Convert these to pounds and feet using my tools.”

The AI will intelligently call kg_to_pounds and meters_to_feet and give you the exact result based on your code.

Source Code

You can find the complete repository with the source code here:

https://github.com/GregoBHM/mcp-unit-converter

Conclusion

Building an MCP server is surprisingly simple. With just a few lines of Python, we extended the capabilities of our AI assistant, making it more reliable for specific tasks like unit conversion.

If you found this useful, check out the video demonstration below!

Happy coding!

Source: DEV Community.

Introduction:

File upload functionality is a ubiquitous feature in modern web applications. From profile pictures and documents to media files and configuration data, users frequently need to upload files to servers. While providing convenience and expanding functionality, this feature also introduces a significant attack surface. Poorly implemented file upload processes can open the door to various security vulnerabilities, ranging from denial-of-service attacks to remote code execution, compromising the integrity, confidentiality, and availability of web applications and their underlying infrastructure. This article delves into the critical security issues surrounding file uploads, outlining common threats, mitigation strategies, and best practices for secure implementation.

Prerequisites:

Before diving into the specifics, a basic understanding of the following is helpful:

• HTTP Protocol: Familiarity with HTTP methods (GET, POST), headers, and request-response lifecycle.
• Web Application Security Fundamentals: Knowledge of common vulnerabilities like XSS, CSRF, and SQL Injection.
• Server-Side Languages: Understanding the basics of the server-side language your application uses (e.g., PHP, Python, Java).
• File Systems and Operating Systems: Basic understanding of file permissions and operating system concepts.

Advantages of File Upload Functionality:

• Enhanced User Experience: Enables users to personalize their experience by uploading profile pictures, custom themes, or other personalized content.
• Data Collection and Management: Facilitates the collection and storage of data from users in various formats (documents, spreadsheets, images).
• Content Management: Allows users to contribute to and manage content on a website or application (e.g., blog posts, forum attachments).
• Application Feature Extension: Extends the functionality of applications by allowing users to upload custom plugins, scripts, or configuration files.
• Collaboration and Sharing: Supports collaboration and file sharing among users within an application.

Disadvantages and Security Risks:

While providing many benefits, improper implementation of file upload functionalities poses several critical risks:

• Remote Code Execution (RCE): Malicious users can upload executable files (e.g., PHP, Python, ASPX) that, when executed by the server, grant them complete control over the system.
• Cross-Site Scripting (XSS): If user-uploaded files are served without proper sanitization, attackers can inject malicious scripts into HTML or other supported formats, allowing them to execute arbitrary code in the context of other users’ browsers.
• Denial-of-Service (DoS): Uploading extremely large files can exhaust server resources (disk space, memory, bandwidth), leading to a denial of service for legitimate users.
• Information Disclosure: Uploading files with sensitive information can lead to its unintentional exposure. Even the act of uploading files without proper access controls can leak information.
• File Inclusion Vulnerabilities: In some cases, file upload vulnerabilities can be chained with local file inclusion (LFI) or remote file inclusion (RFI) vulnerabilities to achieve code execution or other unauthorized access.
• Bypassing Security Measures: Attackers can use various techniques to bypass poorly designed security controls, such as filename manipulation, content type spoofing, or exploiting vulnerabilities in file parsing libraries.
• Storage and Privacy Issues: Lack of proper encryption and access controls on uploaded files can lead to data breaches and privacy violations.

Features of Secure File Upload Implementation:

A robust and secure file upload implementation should incorporate the following key features:

1. File Type Validation:

   • Whitelist Approach: Only allow specific and safe file types.
   • Client-Side and Server-Side Validation: Implement validation on both client and server sides. Client-side validation enhances user experience by providing immediate feedback, while server-side validation is crucial for security as it cannot be bypassed.
   • Magic Number Verification: Check the file’s “magic number” (also known as a file signature) to verify its true type, regardless of the filename extension.

   import magic def is_valid_image(file_path): mime = magic.Magic(mime=True) mime_type = mime.from_file(file_path) if mime_type in ['image/jpeg', 'image/png', 'image/gif']: return True else: return False 

2. Filename Sanitization:

   • Remove Potentially Harmful Characters: Strip or replace characters that could be used in path traversal attacks or script injection (e.g., “..”, “<“, “>”, “;”, “&”).
   • Generate Unique Filenames: Avoid relying on user-provided filenames. Instead, generate unique, unpredictable filenames to prevent file overwriting and potential information disclosure.

   import os import uuid from werkzeug.utils import secure_filename def generate_unique_filename(filename): extension = filename.rsplit('.', 1)[1].lower() unique_filename = str(uuid.uuid4()) + '.' + extension return secure_filename(unique_filename) # Using Werkzeug's secure_filename 

3. File Size Limits:

   • Enforce Maximum File Size: Limit the maximum allowed file size to prevent denial-of-service attacks. Base the limit on the expected use case and server resources.
   • Configure Server-Side Limits: Also configure size limits in the web server (e.g., client_max_body_size in Nginx, LimitRequestBody in Apache).

4. Content Security Policy (CSP):

   • Restrict Script Execution: Use CSP headers to restrict the execution of inline scripts and scripts loaded from untrusted sources. This helps mitigate XSS attacks arising from uploaded files.

   Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline'; object-src 'none'; 

5. Secure Storage:

   • Dedicated Upload Directory: Store uploaded files in a dedicated directory, separate from the web application’s root directory. This helps prevent direct access to executable files.
   • Disable Script Execution: Disable script execution in the upload directory (e.g., using .htaccess in Apache or configuring appropriate server settings).
   • Proper File Permissions: Set appropriate file permissions to restrict access to uploaded files. Ensure that only the web server process has the necessary permissions to read and write files in the upload directory.
   • Encryption: Encrypt sensitive uploaded files at rest and in transit to protect their confidentiality.

6. File Content Scanning:

   • Antivirus Integration: Integrate with an antivirus scanner to scan uploaded files for malware and malicious content.
   • Custom Scanning Logic: Implement custom scanning logic to detect suspicious patterns or code fragments in uploaded files.

7. Input Validation:

   • Validate All Input Fields: Thoroughly validate all input fields associated with the file upload process, including filename, description, and metadata.
   • Escape Output: Always escape data retrieved from uploaded files before displaying it in the browser to prevent XSS attacks.

8. Authentication and Authorization:

   • Authentication: Require users to authenticate before uploading files.
   • Authorization: Implement authorization checks to ensure that users have the necessary permissions to upload files to specific locations or with specific attributes.

9. Logging and Monitoring:

   • Log File Upload Activities: Log all file upload attempts, including successful and failed uploads, filename, file size, user ID, and timestamp.
   • Monitor Logs for Suspicious Activity: Regularly monitor logs for suspicious activity, such as repeated failed upload attempts, uploads of unexpected file types, or large file sizes.

10. Error Handling:

    • Handle Errors Gracefully: Implement robust error handling to gracefully handle unexpected errors during the file upload process.
    • Provide Informative Error Messages: Provide informative error messages to users to help them troubleshoot issues. Avoid exposing sensitive information in error messages.

Code Snippets:

The above examples were written in Python using the Flask framework and the python-magic library. The principles are applicable across languages. Remember to adapt the code to your specific server-side language and framework. Always consult the official documentation for the libraries and frameworks you are using.

Conclusion:

Secure file upload functionality is a crucial aspect of web application security. Neglecting proper security measures can lead to severe consequences, including remote code execution, data breaches, and denial-of-service attacks. By implementing the security features and best practices outlined in this article, developers can significantly reduce the risk of file upload vulnerabilities and protect their web applications and users from harm. Remember that security is an ongoing process, and continuous monitoring, testing, and updates are essential to maintain a secure file upload implementation. Regularly review and update your security measures to address emerging threats and vulnerabilities.

Source: DEV Community.