Top MCP security resources — August 2026

Where the MCP trust boundary sits has been an open argument for months. On July 28 the protocol answered: the specification revision published that day is largely an authorization hardening pass, and it turns a gateway into a policy enforcement point instead of a proxy. The official best practices document was refreshed the same day.

The attack side made the case for why. One demonstrated attack on the Azure DevOps MCP server is enough to hijack a review agent into running cross-project pipelines and exfiltrating wiki data. Attackers are not waiting to be pointed at targets either: SANS ISC counted MCP probes from 49 source IPs in two weeks of ordinary web server logs. Research pushed the same way. A systematic study found taint-style flaws are both common in MCP servers and slow to get fixed. A cross-platform analysis of agentic commerce turned up 33 structural vulnerabilities that succeed deterministically, whichever model is driving. Ten resources below, grouped by topic. Last month’s digest covered the NSA’s hardening guidance and the Amazon Q auto-execution flaws.

Statistics

MCP defense

MCP Specification 2026-07-28

The July 28 revision hardens authorization on several fronts at once: issuer validation per RFC 9207 closes the authorization server mix-up class, client credentials are now bound to their issuing issuer, and Dynamic Client Registration is deprecated in favor of client metadata documents. A stateless core removes session identifiers, and header based routing lets a gateway enforce policy in front of the server. Plan the upgrade around the DCR deprecation, since that is the change most likely to require client work.

MCP security best practices

The official best practices document, updated alongside the specification on July 28. It is the normative companion to the spec rather than independent guidance, and it is versioned to the same date, so read the revision you actually deploy.

ChainWatch: a kill chain aligned sequential detection framework for multi-step attacks in MCP-based AI agent systems

Models MCP attacks as a six-stage kill chain and applies a Hidden Markov Model to tool call sequences. The target is the malicious chain assembled from individually benign invocations, which every per-call defense passes by construction.

Mitigating taint-style vulnerabilities in MCP servers via security aware tool descriptions

A systematic analysis finding that taint-style vulnerabilities are a substantial fraction of MCP server flaws, need significant code changes to fix, and draw slow community responses. The proposed answer, SPELLSMITH, embeds security guidance directly into tool descriptions to steer agents away from unsafe arguments. That is a deliberate bet on defending at the description layer, because fixing the server code does not happen fast enough.

Hybrid analysis for secure MCP tool use in LLM agents

MTGuard combines static and dynamic analysis to block harmful tool invocations across several categories while preserving performance on legitimate user tasks. It works at the individual tool call boundary, which makes it complementary to ChainWatch’s sequence level view rather than a substitute for it.

MCP security 101

How to vet an MCP server: a developer’s MCP server security checklist

A practical pre-installation checklist: verify the publisher, audit exposed tools and permissions, look for poisoned tool descriptions, scope tokens narrowly, pin versions, and require approval for destructive actions. The most valuable item is the last one, treating any untrusted content a server returns as a prompt injection vector rather than as data.

MCP security best practices: a practical guide for 2026

An overview of the main MCP threat classes with separate practical advice for the people running servers and the people building them. Not to be confused with the official document of nearly the same name listed above; this one is community written and better suited to onboarding a team.

MCP incident

Someone is scanning for your MCP servers and AI assistant credentials

Across fourteen days of logs from one modest web host, a July 13 SANS ISC diary counted roughly 200 requests from 49 distinct source IPs hunting for MCP servers, LLM endpoints, and agent configuration. Agent infrastructure has joined .env files and Spring Boot actuators as routine internet background noise, so an exposed mcp.json gets found.

MCP attack technique

When your AI reviewer works for the attacker: a confused deputy bug in Microsoft’s Azure DevOps MCP server

Hidden HTML comments in an Azure DevOps pull request description carry indirect prompt injection, and Microsoft’s official MCP server returns them verbatim without spotlighting. The hijacked review agent then runs cross-project pipelines and exfiltrates confidential wiki data using its own legitimate privileges. This is the confused deputy pattern at its cleanest: the server is faithful, the agent is trusted, and the attacker contributes nothing but text.

Article

Protocol level attacks on agentic commerce platforms: a cross-platform taxonomy, AIP-Bench, and unified defense

Identifies 33 structural, model independent vulnerabilities across agentic commerce platforms that succeed deterministically, then chains three of them into a payment hijack. It ships a taxonomy, the AIP-Bench deterministic benchmark, and a protocol layer defense that drives structural attack success toward zero for most classes. Model independence is the point: no amount of alignment work touches these.

What to do before you upgrade

Start with the July 28 specification, because it is the only item here that changes what your clients must do. Inventory anything relying on Dynamic Client Registration and plan the move to client metadata documents. Confirm your clients validate the issuer per RFC 9207 instead of trusting whichever authorization server they were handed. Then use the stateless core and header based routing as the excuse to put a policy enforcement gateway in front of your servers instead of a pass-through proxy.

The hardening does not need to wait for the upgrade, though, and the cheapest item on the list takes an afternoon: grep your access logs for POST /mcp and for HEAD requests against /.claude/.credentials.json, confirm from an external network that no agent configuration file is reachable from a web root, and check whether /v1/models or /api/tags answers anyone who asks. The SANS numbers say the scans are already arriving. Whether the gateway you put in front actually holds is a separate question, and the way to answer it is MCP red teaming.