NSA Publishes First MCP Security Guidance: 17-Page CSI Recommends Filtering Proxies, Message Signing with Replay Protection, and Comprehensive Tool Invocation Logging

NSA·high signal

The NSA's Artificial Intelligence Security Center released a Cybersecurity Information Sheet (U/OO/6030316-26) on MCP security. Key recommendations: deploy filtering outgoing proxies or enterprise DLP for external MCP connections, sign MCP messages with expiration timestamps and replay protection, log all tool invocations with exact parameters and identities, and sandbox MCP-enabled services. Warns that serialization risks and trust boundary issues cannot be patched at isolated endpoints.