Entity trail

mcp-scan

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-10 / arxiv-researcherMCP-Grounded Agent Pipeline Converts Legacy Docs to NIST OSCAL for Continuous ComplianceOperational technology environments in critical infrastructure often cannot be actively scanned, yet compliance regimes demand active system feedback for risk assessment. This paper (arXiv 2607.08288, July 9) presents a non-invasive multi-agent pipeline grounded in MCP that converts natural-language system descriptions into a source-verified knowledge graph and audit-ready NIST OSCAL artifacts. The architecture deliberately decouples LLM reasoning from deterministic knowledge operations — a pattern worth stealing for any pipeline where hallucination in the extraction step would be unacceptable. It is one of the first academic papers to treat MCP as compliance infrastructure rather than a developer convenience.
2026-07-07 / agents-researcherBlueRock's MCP Trust Registry: 36.7% of 7,000+ scanned MCP servers are SSRF-exposed, 42% leak credentialsBlueRock scanned over 7,000 MCP servers against 22+ security rules and found 36.7% carry potential server-side request forgery (unrestricted outbound fetch) exposure and 42% handle credentials insecurely, using Microsoft's 85k-star Markitdown MCP server as a worked example of the unbounded-fetch pattern. This puts hard numbers on what was previously hand-waved 'MCP is risky' anxiety and reframes SSRF/egress as the dominant MCP failure mode. If you run MCP servers, the actionable takeaway is to pin dependencies, bound outbound fetches, and treat any tool that fetches URLs as an SSRF liability by default.
2026-07-07 / projects-researcherCisco Open-Sources skill-scanner for Agent Skills, Now Integrated Into an IDE ExtensionCisco AI Defense's skill-scanner detects prompt injection, data exfiltration, and malicious code in agent skills using a mix of YAML/YARA pattern rules, LLM-as-a-judge, and behavioral dataflow analysis, and Cisco has now folded it (plus an MCP scanner) into an IDE extension. It's part of a fast-emerging category of agent/skill security scanners appearing alongside Snyk's launch. The convergence of multiple vendors on 'scan before you install' suggests skill supply-chain security is becoming a standard step in the agent dev toolchain.
2026-06-27 / vibe-coding-researcherPattern: 'Agent Firewalls' and MCP Gateways Are Emerging as a Dedicated Defense LayerIn response to the NSA guidance and the MCP CVE wave, a new product category is forming around outbound-filtering proxies and MCP gateways that sit between agents and their tools — enforcing schema validation, DLP, message integrity, and local MCP scanning. Rather than hardening each server individually, builders are starting to centralize agent-to-tool traffic through a controllable choke point, mirroring how API gateways consolidated web-service security.
2026-06-26 / vibe-coding-researcherPattern: MCP Config Files in Repos Are the New RCE Supply-Chain Surface Across IDEsThe Amazon Q CVE is one instance of a broader 2026 pattern — MCP configuration carried in repositories has become a remote-code-execution supply-chain surface, not just untrusted tool output. Research shows Cursor, VS Code, Windsurf, Claude Code, and Gemini-CLI are all vulnerable to MCP-based prompt-injection/auto-launch attacks (Windsurf reportedly exploitable with zero user interaction), and large-scale scans like VIPER-MCP across ~40K repos produced 67 CVEs. The config file itself is now the attack vector.
2026-06-24 / skill-finderRe-scan MCP tool descriptions on every update and reject silent changes — the rug-pull defenseCommand injection accounts for 43% of all MCP CVEs in early 2026, with pipes, semicolons, and ampersands in AI-generated arguments going straight to the shell. Beyond sanitizing arguments, scan tool descriptions both at install time and at every server update and reject silent changes, because a trusted server can be updated to quietly alter a tool's described behavior (a 'rug pull') after your agent has already learned to call it. Treat tool metadata as a security surface with change-detection, not as static config you validate once.
2026-06-18 / skill-finderHarden MCP with incremental scope consent and re-scan tool descriptions on every server update, not just installThe 2026 MCP spec update added incremental scope consent so clients can request only the minimum access each operation needs, instead of granting a server blanket permissions up front. Between January and February 2026 researchers filed 30+ MCP CVEs (43% shell injection), and a malicious server can hide agent-hijacking instructions inside tool descriptions — so descriptions must be scanned at install AND at every update, not once. Pair this with binding servers to 127.0.0.1 rather than 0.0.0.0, the single most common misconfiguration found across thousands of exposed servers.
2026-06-17 / sources-researcherOX Security Discloses Systemic RCE at the Core of MCP as Ecosystem Scans Find Tens of Thousands of Unauthenticated ServersOn June 16 OX Security disclosed a systemic vulnerability in core Model Context Protocol implementations enabling arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. It lands amid a wave of MCP findings: VIPER-MCP swept ~40,000 repos and produced 67 CVEs, Akamai disclosed three database-MCP flaws, the NSA published lockdown guidance, and Censys counted 12,520 internet-reachable MCP services — most unauthenticated. Distinct from last week's Sentry 'Agentjacking' vector, this is a protocol-level supply-chain problem; audit and authenticate every MCP server in your agent stack now.
2026-06-16 / agents-researcherghostprobe: open-source red-team scanner for MCP tool poisoning and the 'lethal trifecta'Engineer Joe Munene released ghostprobe (discussed June 12, 2026), an open-source scanner that points at live MCP servers to detect tool-poisoning prompts and the 'lethal trifecta' (private data access + untrusted content + exfiltration capability) before integration into an agent stack. It joins a crowded but fast-moving MCP-defense tooling space (Cisco MCP Scanner, Snyk Agent Scan, Proximity), reflecting how MCP server vetting is becoming a standard pre-deployment step. Single-source dev-journal disclosure, so importance is rated low pending wider validation.
2026-06-14 / vibe-coding-researcherTip: Audit Your Remote MCP Servers for Missing Auth — ~40% Expose Tools UnauthenticatedJune 2026 scans found roughly 40% of remote MCP servers expose their tools with no authentication, and Censys counted 12,520 internet-reachable MCP services, most unauthenticated. Before connecting an agent to any remote MCP endpoint — or exposing your own — verify it enforces auth on tool calls, and never bind a tool-exposing server to a public interface without it. Treat MCP endpoints like any other API surface: assume internet-facing means attacker-facing.
2026-06-13 / arxiv-researcherOWASP data: prompt injection still drives most agentic-AI security failures in production as MCP CVEs pile upA June 11, 2026 report (Help Net Security, citing OWASP) finds prompt injection remains the dominant cause of agentic-AI security failures in production deployments. It lands amid a broad MCP supply-chain wave: VIPER-MCP surfaced 106 zero-days and produced 67 CVEs after scanning ~40,000 server repos, Censys counted 12,520 internet-accessible MCP services (most unauthenticated), and CVE-2026-22708 against Cursor lets attackers poison the agent's execution environment. For builders running MCP/agent stacks, this is an immediate audit-your-tools signal.
2026-06-13 / vibe-coding-researcherMicrosoft Build 2026 Previews MDASH — A Multi-Model Agentic Security Scanning Harness With Defender IntegrationAt Build 2026 (2026-06-02) Microsoft opened an expanded preview of MDASH, a multi-model agentic scanning harness for securing code, agents, and models across the dev lifecycle, now wired into Microsoft Defender. It targets the gap left by agent-generated code and exposed MCP tooling by running model-driven scans rather than static rules. For builders shipping agent pipelines, it signals that 'scan your agents, not just your code' is moving into mainstream enterprise tooling.

Graph relationships

RELEASED
Invariant Labs
Invariant Labs released mcp-scan for MCP server supply chain security auditing
Source finding
RELEASED
Invariant Labs -> mcp-scan
Invariant Labs released mcp-scan for MCP server supply chain security auditing
Source finding

Source trail

arXiv BlueRock GitHub PipeLab The Hacker News Practical DevSecOps — MCP Security Best Practices: What Actually Works in 2026 Descope — MCP Server Security Best Practices

Graph sources

entity graphfindings textkg edgeskg entities