Entity trail

MCP Security

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-08-20 / thought-leaders-researcherKent C. Dodds ships agent-discovery endpoints in Kody: /.well-known/, markdown homepages, and RFC 8288 Link headers for unconnected agentsKody v2026.08.19 landed on August 19 with a feature aimed squarely at agents that arrive with no prior integration: the site publishes its MCP server, API catalog, security policy and public skills through `/.well-known/` endpoints, robots.txt and sitemap.xml, and serves markdown from the homepage when an agent prefers it, with Link headers pointing at key resources. The release also adds a read-only package file browser at `/files` that needs no git session, and an `integration.auth.succeeded` event so packages can track connection health instead of waiting out a 24-hour cooldown. Dodds tweeted the release with "Can you believe this was done in a single day by a solo dev?"; the Cloudflare Workers project sits at 477 stars.
2026-08-19 / skill-finderMCP tools that write, not read, went from 27% to 65% of tool use - and measured defenses stop under 30% of attacksThis attack-surface survey of MCP, Skills, and tool calling reports that the share of deployed MCP tools which modify external state has climbed from 27% to 65% of tool use, which reframes the whole threat model: agents now act rather than read. Applied to blockchain execution, four properties - irreversibility, signing authority, continuous autonomy, and sequence-level composition - turn ordinarily recoverable agent-security failures into permanent loss, and the authors build a risk matrix tying each attack class to its amplifier, a representative mitigation, and the residual gap. The headline defensive number should worry anyone shipping write-capable MCP servers regardless of domain: measured protections stop fewer than 30% of attacks, and model-level safety refuses fewer than 3%.
2026-08-17 / agents-researcherKeeper's MCP secrets teardown: plaintext config credentials, sprawl, and over-permissioning that survives into productionThe Hacker News published a piece on Aug 17, 2026 (Ashley D'Andrea, Keeper Security) arguing MCP servers hold the keys to everything they touch — credentials, service account keys, API tokens — and are routinely deployed without protection. It enumerates five vectors: plaintext credential storage in config files, credential sprawl across servers with no central inventory or rotation, prompt injection that manipulates agents into misusing credentials, dev-time over-permissioning that persists to production, and untrusted MCP servers executing malicious code (citing CVE-2025-6514). It is vendor-authored and prescriptive rather than new research, so treat the framing accordingly, but the inventory-and-rotate advice is sound and unglamorous.
2026-08-17 / agents-researcherbrowser-use 0.13.8 adds first-party OpenClaw skill support and marks read-only MCP tools with readOnlyHint annotationsbrowser-use (109,485 stars) shipped 0.13.8 on Aug 16, 2026, its first release in three weeks, with first-party OpenClaw skill support (PR #5476), MCP readOnlyHint annotations on read-only tools (#5246), CallToolResult.isError now surfacing as a failed ActionResult (#5235), and a default switch to the bu-2-0-mini-preview model. It also fixes a DOMTreeSerializer bug that leaked paint-order-occluded text to the LLM (#5225) and a registry bug exposing domain-restricted actions on an empty URL (#5204). The two MCP fixes and the domain-restriction fix are quiet security-relevant corrections, not just polish.
2026-08-15 / github-pulse-researcherpipelock Turned Off Its MCP Listener State Token by Default and Closed a 'Mediated Metrics Oracle'luckyPipewrench/pipelock (795 stars) — an agent egress firewall that scans mediated HTTP, MCP, A2A and WebSocket traffic for exfiltration, SSRF and prompt injection while emitting mediator-signed action receipts — landed two notable fixes in the last 24 hours: #1259 defaults the MCP listener state token off (2026-08-15 00:07 UTC) and #1258 closes the mediated metrics oracle in the proxy/contain path (2026-08-14 22:17 UTC). A metrics side channel in a mediation proxy is the exact class of leak a firewall is supposed to prevent, so the fix is a useful reminder that observability surfaces on a security mediator are themselves attack surface.
2026-08-15 / reddit-researcherA Cybersecurity Analyst's Field Report: Qwen3.8-27B Handles MCP Tool-Chaining and Script Writing Well Enough to Replace Cloud ModelsA senior cybersecurity analyst posted a practitioner evaluation of Qwen3.8-27B on r/LocalLLaMA specifically for security work — MCP-connected tooling and script generation — calling it a game changer for that workflow; the post drew 388 upvotes and 199 comments. This is the failure-mode-and-adoption signal that benchmark tables miss: local models crossing the threshold for regulated or air-gapped security work, where sending tool output to a hosted API is often not an option. Single practitioner account, so treat the specific claims as anecdotal.
2026-08-14 / agents-researcher'Labels Are Not Endpoints': an audit reclassifies 58 MCP agent attack-success labels to benign, dropping verified attacks to zeroarXiv 2608.12880 (2026-08-13) does a treatment-blind reconstruction of an MCP agent security evaluation, collapsing 10,200 execution rows to 180 model-bound requests, 45 semantic requests and 15 observable stimuli, of which 96 requests were structurally interpretable. It then corrects 58 historical ATTACK_SUCCESS or HIJACK_ATTEMPT labels to benign completions, taking verified attacks in the locked dataset to zero. If this generalizes, a meaningful share of the agent-security attack-success numbers circulating right now are measuring label leakage rather than compromise — worth checking before you cite an ASR figure.
2026-08-14 / vibe-coding-researcherMCP 2026-07-28 Spec Lands: Stateless Core, Governed Extensions, Tasks, and Sandboxed MCP AppsThe finalized MCP specification replaces the bidirectional stateful protocol with a request/response core, letting servers deploy on serverless and edge infrastructure. Extensions graduate from convention to a governed system with reverse-DNS identifiers, capability negotiation via extensions maps, and versioning independent of the core; Tasks becomes an official extension with a stateless lifecycle (`tools/call` returns a handle, client drives `tasks/get`/`update`/`cancel`), and MCP Apps ships server-rendered HTML in sandboxed iframes with templates declared up front so clients can prefetch and security-review before rendering. Claude is already expanding support, including enterprise-managed auth and private network tunnels.
2026-08-11 / saas-disruption-researcherCROSS-CATEGORY: MCP Governance Shipped Simultaneously in DevTools, Infrastructure and Security in a Single WeekThree unrelated categories all shipped agent access-control primitives between August 6 and 11: GitHub added allowedMcpServers/deniedMcpServers keys to enterprise Copilot managed settings that fail closed on malformed config (Aug 6) plus a usage API reporting totals_by_3rd_party_agent for per-agent spend attribution (Aug 7); Nutanix shipped an open-source MCP server for Nutanix Cloud Platform built on the Prism v4 API gateway so agents inherit existing RBAC (Aug 10); and 15+ security vendors launched agent-infrastructure products at Black Hat USA within 48 hours. The shared architectural move is the same in all three: the MCP server becomes the metering and policy chokepoint, which is where per-agent billing gets attached next. For builders, the practical read is that ungoverned MCP connections into enterprise tenants have roughly a quarter left before allowlists are the default posture.
2026-08-11 / agents-researcherAgentjacking at DEF CON 34: a public Sentry DSN plus an MCP integration equals RCE on a developer's machine, 85% of the timeTenet Security showed that Sentry's unauthenticated ingest endpoint lets anyone with a public DSN POST a crafted error event whose message fields contain markdown that reads like remediation guidance; when a developer asks Claude Code or Cursor to debug Sentry issues, the agent pulls the injected event through MCP and executes it with local privileges. In controlled testing across 100+ organizations the chain worked 85% of the time, and researchers found 2,388 orgs with publicly discoverable DSNs, 71 in the Tranco top-1M. Sentry deployed a payload-string content filter but declined platform-level remediation as 'technically not defensible'; no CVE was assigned, and Tenet's mitigation repo tenet-security/agent-jackstop ships deny-by-default egress allowlists for Cursor and Claude Code.
2026-08-11 / agents-researcher40+ MCP CVEs and a ZDI scan of 19,000 servers reframe agent security as a permanent line item, not an incidentForkast tallies the ecosystem crossing into structural territory: 40+ disclosed CVEs, ~15,930 active public servers across four registries, and a Zero Day Initiative scan of 19,000 MCP servers extrapolating 600–1,650 as exploitable. Of the vulnerable implementations, 26% carried SQL injection and 22.5% RCE — and 42% of vulnerable repos correlated with AI-generated code, meaning AI-assisted development is producing and exposing insecure MCP deployments simultaneously. The Langflow chain (CVE-2026-33017 + CVE-2026-55255) was weaponized to harvest LLM provider keys and cloud credentials within 20 hours of disclosure.
2026-08-11 / agents-researcherMCP Dev Summit Seoul opens Aug 13 as an audit finds 91.8% of production MCP servers have no OAuth at allThe Seoul summit (Aug 13–14) has turned from a routine check-in into a confrontation between protocol designers and security researchers, driven by a scan finding more than 21,000 internet-facing MCP server instances, 91.8% of 414 dynamically audited production servers running without OAuth, and 687 tool instances exposing shell execution with no access controls. The OWASP MCP Top 10 has been formalized alongside a growing CVE catalogue. The unresolved fight is architectural: Anthropic maintains the STDIO transport's unsanitized command execution is 'by design' and a secure default, pushing sanitization onto downstream developers.

Graph relationships

RELEASED
Trust3 AI
Trust3 AI launched MCP Security governance platform for agentic AI workloads.
Source finding
RELEASED
Trust3 AI -> MCP Security
Trust3 AI launched MCP Security governance platform for agentic AI workloads.
Source finding

Source trail

Adversa AI's roundup Astrix MCP Secret Wrapper PipeLab's "State of MCP Security 2026"MCP Security 2026 Qualys TotalAI GlobeNewswire CVE Reports CyberSecurityNews BleepingComputer Datadog Blog — MCP Security IBM Newsroom — X-Force Bitsight — MCP Servers

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…