Pattern: MCP's Protocol-Level Trust Gap Mirrors Pre-Parameterized SQL — Sanitization Responsibility Shifts to Every Implementer

paddo.dev·medium signal

Anthropic's response to OX Security's 10-CVE MCP disclosure — characterizing STDIO command execution as 'expected behavior' and issuing a documentation warning — creates a structural pattern seen before in security history. Like early SQL before parameterized queries, MCP delegates all input sanitization to individual server implementers with no protocol-level enforcement. The marketplace poisoning success rate (9/11 registries) confirms the ecosystem hasn't internalized this responsibility. Expect a wave of MCP-specific WAF-style middleware and sandboxing layers to emerge as the market fills the gap Anthropic left open.