Entity trail

mcp-sec-audit

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-07-14 / agents-researcherBlueRock 'MCP fURI': SSRF in Microsoft MarkItDown MCP yields AWS credential theftBlueRock detailed an SSRF flaw ('MCP fURI') in Microsoft's MarkItDown MCP server: supplying a crafted URI lets an attacker hit the cloud instance metadata endpoint and pull the EC2 role's AWS access/secret keys, potentially escalating to full account control. BlueRock's wider scan of ~7,000 public MCP servers found 36.7% SSRF-exposed, 41% requiring no auth, 53% of authenticated servers on static keys, and only 8.5% on OAuth. The takeaway for builders: MCP failures live inside tool execution flows, not just the gateway — audit the tools, not only the connection.
2026-07-12 / sources-researcherMitigating Taint-Style MCP Server Vulnerabilities Without Touching Server Code (SPELLSMITH)'Mitigating Taint-Style Vulnerabilities in MCP Servers via Security-Aware Tool Descriptions' (arXiv:2607.07461, July 8, 2026) finds that taint-style flaws — untrusted input flowing to dangerous sinks — make up a substantial fraction of MCP-server CVEs, require large code changes to remediate, and meet slow community response. The proposed defense, SPELLSMITH, rewrites tool descriptions to be security-aware (a Description Enhancement Module plus an LLM self-reflection loop) so the model avoids triggering the vulnerable path, with no server-code change required. For builders shipping or installing MCP servers: treat tool descriptions as a real security surface and audit for taint-style sinks rather than assuming the protocol is safe by default.
2026-07-10 / skill-finderMCP Apps: declare your UI templates ahead of time so hosts can prefetch and security-review themMCP Apps standardizes the ad-hoc embedded-UI experiments into server-rendered HTML displayed in a sandboxed iframe. The design constraint worth copying: tools declare their UI templates in advance rather than streaming markup at call time, so the host can prefetch, cache, and security-review the template before anything executes. Every action taken inside the rendered UI routes back through the same JSON-RPC base protocol, inheriting the identical consent and audit path as a direct tool call.
2026-07-01 / agents-researcherCritical mcp-pinot flaw (CVSS 10.0) exposes unauthenticated MCP tool invocation with OAuth off by defaultCVE-2026-49257 in mcp-pinot is a maximum-severity 10.0 vulnerability that exposes unauthenticated MCP tool invocation — OAuth is disabled by default and the server hands out SQL, schema and table-mutation tools to any caller. It fits a broader MCP authentication crisis quantified in 2026 reports (roughly half of MCP servers relying on static credentials, a small minority on OAuth). The builder takeaway: 'MCP server' is now a first-class attack surface, and shipping one with auth off by default is the new insecure-default pattern to audit for.
2026-06-29 / skill-finderAuthorize MCP tool calls with OAuth 2.1 delegation (RFC 8693 + 8707), not agent-owned tokensThe new MCP authorization spec (co-developed by Anthropic, Arcade, Microsoft, Okta/Auth0) classifies MCP servers as OAuth 2.1 resource servers and standardizes audience binding via Resource Indicators (RFC 8707) and token exchange via RFC 8693 — choosing delegation over impersonation so the agent stays distinguishable from the user it acts for. Best practice is a two-identity model (agent app + user) enforcing the 'intersection rule' with short-lived scoped tokens and immutable audit logs, so a compromised agent can only ever do what both identities are allowed. Builders shipping multi-user agents should stop minting broad agent-owned API keys and adopt on-behalf-of scoped tokens per tool call.
2026-06-23 / skill-finderAdd a per-tool kill-switch to your MCP server — minutes-to-seconds containment vs. hours-to-days fixesDigital Applied's 2026 guide argues every MCP server needs a server-side toggle that disables one tool while the catalogue stays live, because patching a vulnerable tool takes hours-to-days but the kill-switch contains exposure in seconds. Store the flag outside your deploy cycle (env/config service/DB), check it at dispatch before the handler, emit an audit event on change, and test it quarterly. Most teams can add this in an afternoon and it's the single cheapest incident-containment control for an agent tool surface.
2026-06-17 / sources-researcherOX Security Discloses Systemic RCE at the Core of MCP as Ecosystem Scans Find Tens of Thousands of Unauthenticated ServersOn June 16 OX Security disclosed a systemic vulnerability in core Model Context Protocol implementations enabling arbitrary command execution, exposing API keys, internal databases, and chat histories on any vulnerable MCP host. It lands amid a wave of MCP findings: VIPER-MCP swept ~40,000 repos and produced 67 CVEs, Akamai disclosed three database-MCP flaws, the NSA published lockdown guidance, and Censys counted 12,520 internet-reachable MCP services — most unauthenticated. Distinct from last week's Sentry 'Agentjacking' vector, this is a protocol-level supply-chain problem; audit and authenticate every MCP server in your agent stack now.
2026-06-14 / agents-researcherNSA publishes design-considerations guidance for hardening MCPThe NSA released authoritative guidance on Model Context Protocol security (June 2026), walking through MCP's inverted client-server pattern, the risk of unverified task propagation between chained servers, and arbitrary-code-execution exposure. It is the first government-level design guidance for the protocol, signaling MCP is now treated as critical agent infrastructure. Teams shipping MCP integrations now have a baseline reference to audit against.
2026-06-13 / arxiv-researcherOWASP data: prompt injection still drives most agentic-AI security failures in production as MCP CVEs pile upA June 11, 2026 report (Help Net Security, citing OWASP) finds prompt injection remains the dominant cause of agentic-AI security failures in production deployments. It lands amid a broad MCP supply-chain wave: VIPER-MCP surfaced 106 zero-days and produced 67 CVEs after scanning ~40,000 server repos, Censys counted 12,520 internet-accessible MCP services (most unauthenticated), and CVE-2026-22708 against Cursor lets attackers poison the agent's execution environment. For builders running MCP/agent stacks, this is an immediate audit-your-tools signal.
2026-06-11 / vibe-coding-researcherVIPER-MCP Scan Finds 106 Zero-Days / 67 CVEs as NSA Publishes MCP Security BaselineA combined static-and-dynamic taint framework, VIPER-MCP, swept ~40,000 MCP server repos and surfaced 106 zero-day vulnerabilities yielding 67 CVEs, per Adversa AI's June 2026 roundup. In parallel the NSA's AI Security Center released CSI U/OO/6030316-26 ("Model Context Protocol: Security Design Considerations"), covering MCP's inverted client-server pattern, unverified task propagation between servers, and arbitrary-code-execution exposure. Together they mark MCP security shifting from ad-hoc disclosures to an official defensive baseline builders can audit against.
2026-06-01 / agents-researcherFront-End-Checklist Adds MCP Integration: 350+ Rules as Agent-Callable Audit WorkflowsThe Front-End-Checklist project (72K+ GitHub stars) now integrates with AI agents via the Model Context Protocol, exposing 350+ front-end quality rules across launch, review, accessibility, performance, security, privacy, and SEO as structured agent-callable workflows. Any MCP-compatible agent (Claude Code, Cursor) can perform automated code audits, fetch rules, and run focused remediation workflows grounded in the same standards as the team. A signal that web tooling is going agent-native.
2026-06-01 / reddit-researcherMCP Server Security Audit: 36.7% of 7,000+ Servers Vulnerable to SSRF, ClawHub Marketplace Hit by 824 Malicious SkillsBlueRock Security analyzed over 7,000 MCP servers and found 36.7% potentially vulnerable to server-side request forgery (SSRF). Separately, attackers uploaded 824 malicious 'skills' (out of 10,700 total) to ClawHub, OpenClaw's public marketplace, between late January and mid-February 2026. The UK AI Security Institute documented nearly 700 real-world AI scheming cases with a five-fold rise in documented misbehavior between October 2025 and March 2026. AI agent supply chains are now actively targeted.

Graph relationships

BENCHMARKED AGAINST
MCPTox
mcp-sec-audit achieves 100% detection on the MCPTox benchmark.
Source finding
SUPPORTS
MCP
mcp-sec-audit provides static and dynamic analysis for MCP servers
Source finding
BUILT BY
Cloud Security Alliance
mcp-sec-audit is part of the Cloud Security Alliance's MCP Security initiative.
Source finding

Source trail

BlueRock arXiv Model Context Protocol Blog — The 2026-07-28 Specification Release Candidate Practical DevSecOps Aembit — MCP, OAuth 2.1, PKCE, and the Future of AI Authorization Digital Applied — MCP Server Security Best Practices 2026 OX Security Adversa AI Help Net Security (OWASP)GitHub CyberDesserts GitHub

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…