The NSA published its first authoritative baseline for securing MCP deployments.

The guidance walks through MCP's inverted client-server pattern, unverified task propagation between servers, and arbitrary-code-execution exposure (Adversa AI). The single highest-impact line: put authentication in front of every remote MCP server and pull unauthenticated ones off the public internet. When the NSA writes baseline guidance for your protocol, the protocol is critical infrastructure now. Treat it that way.