MCP SECURITY RESEARCH
Public inspection observations and primary sources on MCP vulnerabilities, permissions, and adoption review.
47 articles
Latest research
An MCP approval belongs to the reviewed artifact, installation route, permissions, credentials, and network destinations. A change in any of those fields requires a bounded review of the affected evidence before continued use.
An official mcp-server-git advisory affected versions before 2026.1.14 through git_add path handling. Triage requires the deployed version, reachable tool path, process-visible files, and verified upgrade or isolation evidence.
Read articleNEED_REVIEW identifies unresolved facts to check before adoption. It proves neither safety nor a vulnerability; reviewers need evidence for the version, configuration, and permissions they intend to use.
Read articleMCP gives each client one server connection, while the host aggregates context across clients. That connection isolation does not authorize copying data from one server into another tool call.
Read articlereadOnlyHint describes whether a tool claims to modify its environment. It does not enforce that claim or rule out data disclosure, external requests, billing, audit records, or effects caused by composition.
Read articleA credential injected through the environment can spread through processes, child processes, API requests, and logs. Redaction is a final safeguard; scope, inheritance, storage, and log access remain separate controls.
Read articleA familiar package name and valid provenance do not establish an unchanged artifact, dependency tree, or build. Adoption evidence should separately bind the version, digest, publisher identity, and reviewed change.
Read articleSearch results, tickets, documents, and MCP resources can contain text that looks like an instruction. Hosts need a source boundary that keeps retrieved content from authorizing tool calls or outbound disclosure.
Read articleA tool name, description, and schema can guide model behavior without proving what the server can access or where data can go. Adoption review must compare the full declaration with runtime permissions, call inputs, and network destinations.
Read articleLegacy MCP sessions can correlate transport state but must not authenticate a user. Current MCP removes protocol sessions; both generations require per-request authorization and principal-bound application state.
Read articleA local MCP HTTP server can be reached by browser code through DNS rebinding. Binding to loopback, validating each incoming Origin, and authenticating requests are separate adoption requirements.
Read articleRemote MCP authorization can make a client fetch server-supplied metadata URLs. Adoption should constrain every discovery hop, DNS result, redirect, and outbound route before credentials or internal services are exposed.
Read articleWhen many dynamically registered MCP clients share one upstream OAuth client ID, upstream consent cannot prove approval for each client. Per-client consent and exact redirect URI matching preserve the missing boundary.
Read articleThe token from an MCP client and the token for an upstream API belong to separate authorization relationships. Resource, audience, issuer, and validation boundaries show when passthrough can expose another backend's permissions.
Read articleA published mcp-server-git vulnerability failed to enforce that each repo_path stayed within the repository selected at startup. Acceptance requires resolved-path containment, verified launch configuration, and narrow process access.
Read articleA published mcp-server-git vulnerability let ref inputs to git_diff and git_checkout become Git CLI options, creating a local-file overwrite path. Adoption requires a patched artifact, semantic ref validation, and restricted process authority.
Read articleA text-prefix check can mistake a similarly named sibling for a child of an allowed directory. The official advisory and patch show why containment requires path-component boundaries and deployed-artifact verification.
Read articleA symlink that appears inside an allowed directory may resolve to a file outside it. The official advisory and patch turn real-path validation, deployed-package review, and OS isolation into concrete adoption conditions.
Read articleCommand execution and file access are not automatically MCP vulnerabilities. Distinguishing intended permissions, defects that cross a boundary, and missing evidence makes the choice between updating, isolating, and investigating more precise.
Read articleIn a 20,629-entry Registry snapshot, MCP Guard observed 60 automation/workflow entries, 53 monitoring/observability entries, and 44 testing/quality entries. These 157 operational entries should be reviewed for environment boundaries, change approval, notification noise, audit logs, and rollback.
Read articleIn a 20,629-entry public Registry snapshot, MCP Guard observed 385 search/knowledge entries, 84 documentation entries, and 61 analytics/BI entries. These 530 entries sit close to answer evidence and internal knowledge, so adoption review should record source authority, freshness, citation or logs, outbound destinations, and read scope.
Read articleAmong 20,629 public Registry entries, 258 were security/auth, 203 database, and 117 cloud-provider entries. This 578-entry, 2.8% slice is small but close to identity, data, and cloud control planes, so adoption review should check credentials, scope, audit logs, and rollback before use.
Read articleOut of 20,629 public Registry entries, only 419 were PASS and 20,210 were in WARN, NEED_REVIEW, RESTRICT, or BLOCK. MCP adoption review should separate runtime boundary, provenance, authentication, mutation authority, and unresolved evidence instead of treating review as a simple allow/block decision.
Read articleUsing 20,629 public Registry entries and 11,627 profile-evidence rows, weekly MCP security review should track more than total count: status distribution, growing capabilities, source/auth gaps, and runtime boundary.
Read articleRemote public service profiles total 278, while local subprocess profiles total 10,335. MCP adoption should not use the same checklist for both models.
Read articledetailed profile rows include 1,832 npm-package targets and 8,376 git-repository targets. Easy npx installation makes package source, version pinning, and install behavior important.
Read articleThe public Registry has 16,649 entries in the other category. This does not make the category useless; it shows that MCP use cases are expanding faster than taxonomy.
Read article349 detailed profile rows are classified as non-MCP. Separating lookalike entries from real MCP servers prevents false adoption signals.
Read articleResource-intensive signals appear in 1,398 profiles. MCP risk includes API quota, database reads, external billing, and local resource consumption, not only data leakage.
Read articleCredential-access signals appear in 487 profiles. When MCP touches API keys, OAuth, sessions, or local environment secrets, ownership and scope must be explicit.
Read articleThere are 683 cross-server relay signals and 6,032 outbound-write signals in detailed profile rows. MCP review needs to track where agent-accessed data can move.
Read articledetailed profile rows include 3,213 tool-authority observations. In MCP, tool names and descriptions are part of the authority boundary exposed to an AI agent.
Read articleThe public Registry has 5,394 NEED_REVIEW rows. This is not inspection failure; it is an explicit state for missing evidence that matters to adoption.
Read articleThe 20,629-entry public Registry snapshot contained 419 PASS entries. A dated public result does not guarantee safety for another version, configuration, or deployment.
Read articledetailed profile rows show 5,389 JavaScript entries and 2,470 Python entries. MCP review should prioritize Node/npm and Python package supply-chain and runtime behavior.
Read articledetailed profile rows include 1,213 remote MCP targets and 596 remote descriptor successes. Remote MCP is smaller than local subprocess, but its auth, origin, and data-flow boundaries differ.
Read articleAuthentication type is unknown for 11,171 detailed profile rows and credential model is unknown for 11,098. Smaller groups still show API keys, OAuth, or local environment secrets.
Read article2,005 profiles fall into source-resolution gaps. Repository-not-found accounts for 1,290 rows and missing provenance metadata for 632, making provenance review a major adoption issue.
Read articleFilesystem-mutation profiles total 1,425, with 4,365 file-read signals and 3,321 file-write signals. Workspace boundaries are central to MCP adoption review.
Read article2,555 profiles can mutate external services or remote state. For write-capable MCP servers, auditability, scope, and rollback matter more than for read-only integrations.
Read article2,858 detailed profile rows fall into command-or-code execution capability. Execution is useful, but when it overlaps with outbound access or file mutation, review priority rises.
Read articleAmong 11,627 detailed profile rows, 10,335 are local subprocess entries and 10,070 use stdio. MCP security is often about what gets launched on the local machine, not only what remote API is called.
Read articleDeveloper tools are the largest explicit category in the public Registry with 2,333 entries. These servers can be valuable, but they sit close to code, files, CLIs, and external APIs.
Read articleWARN (9,925), NEED_REVIEW (5,394), and RESTRICT (4,881) do not mean the same thing. MCP adoption workflows need to separate caution, evidence gaps, and restriction.
Read articleOut of 20,629 public Registry entries, 20,210 fall into WARN, NEED_REVIEW, RESTRICT, or BLOCK. The key lesson is that MCP review needs a workflow for uncertainty, not only a blocklist.
Read articleThe public Registry now covers 20,629 inspected MCP entries. WARN, NEED_REVIEW, RESTRICT, and BLOCK together account for 20,210 rows, meaning 98% of visible entries need some form of review before adoption.
Read articleAcross a 10-server MCP sample, download counts and inspection verdicts did not move together. Popularity was useful as a distribution signal, but not as evidence of lower observed risk.
Read article