News, analysis, and best practices for the Model Context Protocol ecosystem. https://mcpblog.dev en Tue, 11 Aug 2026 20:36:55 GMT https://mcpblog.dev/blog/2026-05-30-agentseal-1808-mcp-servers-toxic-data-flows https://mcpblog.dev/blog/2026-05-30-agentseal-1808-mcp-servers-toxic-data-flows A May 2026 scan of 1,808 public MCP servers surfaced 8,282 security findings across 16,840 tools. The headline number is that 66% of servers had findings — but the more important result is the toxic-data-flow pattern, a class of risk that no single-server scanner can see. Sat, 30 May 2026 00:00:00 GMT Algis Dumbris mcp-security agentseal toxic-data-flows research data-exfiltration gateway https://mcpblog.dev/blog/2026-05-30-mcp-cve-wave-2026-mcpwn-mcpoison-rce https://mcpblog.dev/blog/2026-05-30-mcp-cve-wave-2026-mcpwn-mcpoison-rce Three CVEs now define the practical security posture of the Model Context Protocol in 2026 — MCPwn on the server side, an mcp-remote RCE on the client side, and MCPoison at the trust boundary. Together they show that every layer of an MCP connection has been exploited, and that the common defense is structural, not a patch. Sat, 30 May 2026 00:00:00 GMT Algis Dumbris mcp-security cve mcpwn mcpoison mcp-remote vulnerabilities gateway https://mcpblog.dev/blog/2026-05-30-nsa-mcp-security-guidance-pp-26-1834-field-guide https://mcpblog.dev/blog/2026-05-30-nsa-mcp-security-guidance-pp-26-1834-field-guide On May 20, 2026 the NSA released a Cybersecurity Information Sheet naming nine specific security controls for production MCP deployments, with a September 30 federal-contractor deadline. This is a plain-language field guide to what each requirement asks for and what it means for the way you actually build. Sat, 30 May 2026 00:00:00 GMT Algis Dumbris mcp-security nsa compliance audit-logging sandboxing governance gateway https://mcpblog.dev/blog/2026-05-12-eu-ai-act-article-12-delay-what-still-has-a-2026-deadline https://mcpblog.dev/blog/2026-05-12-eu-ai-act-article-12-delay-what-still-has-a-2026-deadline The EU Council and Parliament agreed on May 7 to push the high-risk AI compliance deadline from August 2026 to December 2027. Multiple parallel mandates — DORA, NIS2, GPAI obligations, transparency rules — did not move. Here is what the Omnibus VII delay actually changes for organizations deploying AI agents. Tue, 12 May 2026 00:00:00 GMT Algis Dumbris eu-ai-act article-12 omnibus-vii dora nis2 compliance regulation governance https://mcpblog.dev/blog/2026-05-12-mcp-2026-roadmap-anthropic-names-enterprise-gaps https://mcpblog.dev/blog/2026-05-12-mcp-2026-roadmap-anthropic-names-enterprise-gaps Anthropic published the official 2026 MCP roadmap. Four enterprise gaps are named directly — audit trails, SSO-integrated auth, gateway behavior, configuration portability — and the spec team is explicitly routing them through extensions and a new Enterprise Working Group rather than into the core protocol. Tue, 12 May 2026 00:00:00 GMT Algis Dumbris mcp modelcontextprotocol roadmap anthropic enterprise working-group audit governance https://mcpblog.dev/blog/2026-05-10-state-of-mcp-security-2026-pipelab-numbers https://mcpblog.dev/blog/2026-05-10-state-of-mcp-security-2026-pipelab-numbers PipeLab's State of MCP Security 2026 is the first comprehensive defense-coverage grading for the MCP ecosystem. 24,008 exposed secrets. 82% path-traversal vulnerability rate. Eight named in-the-wild incidents. The numbers describe a category that has outgrown its own tooling. Sun, 10 May 2026 00:00:00 GMT Algis Dumbris mcp security pipelab owasp audit supply-chain ecosystem state-of https://mcpblog.dev/blog/2026-04-20-341-malicious-skills-zero-registry-checks https://mcpblog.dev/blog/2026-04-20-341-malicious-skills-zero-registry-checks In January 2026, 341 malicious skills infiltrated OpenClaw's official registry. The MCP ecosystem faces the same structural vulnerability — and scanning alone won't fix it. Mon, 20 Apr 2026 00:00:00 GMT Algis Dumbris mcp security registry supply-chain openclaw ClawHavoc https://mcpblog.dev/blog/2026-04-20-attack-gets-better-ai-gets-smarter https://mcpblog.dev/blog/2026-04-20-attack-gets-better-ai-gets-smarter Unit 42's MCPTox benchmark found 72.8% attack success on o1-mini. More capable models are more vulnerable to MCP sampling injection because the attack exploits instruction-following. You cannot model-upgrade your way out of this. Mon, 20 Apr 2026 00:00:00 GMT Algis Dumbris MCP security sampling prompt-injection Unit42 MCPTox OWASP https://mcpblog.dev/blog/2026-04-19-14k-servers-scanned-admission-gap https://mcpblog.dev/blog/2026-04-19-14k-servers-scanned-admission-gap Three independent teams scanned 14,000+ MCP servers in 30 days. All found the same vulnerabilities. All ended with the same recommendation. None of them could enforce it. Sun, 19 Apr 2026 00:00:00 GMT Algis Dumbris mcp security scanning ecosystem admission-control https://mcpblog.dev/blog/2026-04-17-mcp-deprecating-sampling-roots-logging https://mcpblog.dev/blog/2026-04-17-mcp-deprecating-sampling-roots-logging SEP-2577 proposes removing three core MCP features simultaneously. The protocol is scope-reducing to become a lean stateless tool-calling layer. Here is what builders need to know. Fri, 17 Apr 2026 00:00:00 GMT Algis Dumbris mcp protocol sampling deprecation ecosystem https://mcpblog.dev/blog/2026-04-10-658x-amplification-attack https://mcpblog.dev/blog/2026-04-10-658x-amplification-attack A new class of MCP attack turns tool responses into a billing amplifier. A session that should cost $0.10 costs $65.80. The schema is clean, the task completes, and 97% of standard defenses never notice. Fri, 10 Apr 2026 00:00:00 GMT Algis Dumbris mcp security attack economics research https://mcpblog.dev/blog/2026-04-08-three-governance-gaps-multi-agent-systems https://mcpblog.dev/blog/2026-04-08-three-governance-gaps-multi-agent-systems Three independent teams arrived at the same conclusion this week: multi-agent systems fail silently because nobody instruments delegation, escalation, or reputation. Here are the practical instrumentation points. Wed, 08 Apr 2026 00:00:00 GMT Algis Dumbris multi-agent governance delegation observability mcp a2a agent-coordination https://mcpblog.dev/blog/2026-04-07-mcp-sampling-attack-vector https://mcpblog.dev/blog/2026-04-07-mcp-sampling-attack-vector MCP sampling lets servers request LLM completions through the client. Unit42 research shows how this legitimate spec feature enables prompt injection, cross-server poisoning, privilege escalation, and data exfiltration. Tue, 07 Apr 2026 00:00:00 GMT Algis Dumbris mcp security sampling prompt-injection unit42 spec https://mcpblog.dev/blog/2026-04-07-q1-2026-mcp-cve-roundup https://mcpblog.dev/blog/2026-04-07-q1-2026-mcp-cve-roundup MCP went from zero CVEs to nine in a single quarter. A data-driven breakdown of every vulnerability, the three recurring patterns behind them, and what the ecosystem should do next. Tue, 07 Apr 2026 00:00:00 GMT Algis Dumbris mcp security cve vulnerability protocol https://mcpblog.dev/blog/2026-03-31-mcp-oauth-gap-gateway-architecture https://mcpblog.dev/blog/2026-03-31-mcp-oauth-gap-gateway-architecture A study of 5,200+ MCP servers found 88% require credentials, 53% use static API keys, and only 8.5% use OAuth. Six RSAC vendors announced MCP governance — none fix these numbers. The gateway layer does. Tue, 31 Mar 2026 00:00:00 GMT Algis Dumbris security MCP OAuth authentication gateway https://mcpblog.dev/blog/2026-03-25-approved-server-exfiltration-problem https://mcpblog.dev/blog/2026-03-25-approved-server-exfiltration-problem Quarantine catches obvious malware. Docker contains filesystem access. But an approved, isolated MCP server with outbound network access can silently POST every tool call payload to an attacker. Here is what to do about it. Wed, 25 Mar 2026 00:00:00 GMT Algis Dumbris security MCP exfiltration network-isolation defense-in-depth https://mcpblog.dev/blog/2026-03-25-litellm-supply-chain-docker-isolation https://mcpblog.dev/blog/2026-03-25-litellm-supply-chain-docker-isolation LiteLLM v1.82.7 was compromised via a poisoned GitHub Action. The .pth malware fires on every Python startup, stealing SSH keys, cloud creds, and API keys. Many MCP servers pull LiteLLM as a transitive dependency. Wed, 25 Mar 2026 00:00:00 GMT Algis Dumbris security MCP supply-chain Docker LiteLLM isolation https://mcpblog.dev/blog/2026-03-23-single-agent-era-over https://mcpblog.dev/blog/2026-03-23-single-agent-era-over In 72 hours: Microsoft AutoGen retired, GitHub launched Squad, Block's Goose pivoted to multi-agent. Three independent signals, same conclusion: the single-agent architecture is done. Mon, 23 Mar 2026 00:00:00 GMT Algis Dumbris multi-agent MCP architecture AutoGen GitHub-Squad Goose https://mcpblog.dev/blog/2026-03-22-identity-vs-tool-call-security https://mcpblog.dev/blog/2026-03-22-identity-vs-tool-call-security Microsoft, CyberArk, and Okta frame AI agent security through identity. But identity alone does not prevent tool poisoning or parameter manipulation. The MCP gateway layer is the missing half. Sun, 22 Mar 2026 00:00:00 GMT Algis Dumbris security MCP identity gateway architecture https://mcpblog.dev/blog/2026-03-21-430m-ai-agent-security-vc https://mcpblog.dev/blog/2026-03-21-430m-ai-agent-security-vc March 2026 saw $430M+ invested in AI agent security across 5 major rounds. Combined with 30 CVEs, 9 documented MCP breaches, and 1,184 malicious skills, the market signal is unmistakable. Sat, 21 Mar 2026 00:00:00 GMT Algis Dumbris security MCP VC market-analysis AI-agents https://mcpblog.dev/blog/2026-03-21-chmod-ai-agents-mcp-permissions https://mcpblog.dev/blog/2026-03-21-chmod-ai-agents-mcp-permissions Three radically different permission models for MCP emerged this month: Unix-style rwxd, DIFC labels, and scope-per-service. The winner will define how enterprises govern AI agent tool access. Sat, 21 Mar 2026 00:00:00 GMT Algis Dumbris security MCP permissions architecture agents https://mcpblog.dev/blog/2026-03-20-azure-ssrf-mcp-gateway-security https://mcpblog.dev/blog/2026-03-20-azure-ssrf-mcp-gateway-security The first high-profile MCP CVE (CVSS 8.8) in Azure's MCP Server plus Token Security's MCPwned RSAC presentation show why every MCP deployment needs a gateway layer that inspects tool calls before they reach upstream servers. Fri, 20 Mar 2026 00:00:00 GMT Algis Dumbris security MCP CVE Azure gateway RSAC https://mcpblog.dev/blog/2026-03-20-gateways-vs-hooks-complementary https://mcpblog.dev/blog/2026-03-20-gateways-vs-hooks-complementary Security Boulevard argues gateways are a bad idea for MCP. They are half right. The best architecture uses both gateways for perimeter defense and hooks for runtime context. Here is how they fit together. Fri, 20 Mar 2026 00:00:00 GMT Algis Dumbris security MCP gateway hooks architecture defense-in-depth https://mcpblog.dev/blog/2026-03-19-mcp-security-enterprise-category https://mcpblog.dev/blog/2026-03-19-mcp-security-enterprise-category In five days, three companies launched dedicated MCP security products. Combined with OWASP MCP Top 10 and CoSAI's threat taxonomy, MCP security has transitioned from research concern to funded enterprise market. Thu, 19 Mar 2026 00:00:00 GMT Algis Dumbris security MCP enterprise gateway market-analysis https://mcpblog.dev/blog/2026-03-18-real-mcp-attacks-gateway-defenses https://mcpblog.dev/blog/2026-03-18-real-mcp-attacks-gateway-defenses MCP security has moved from theoretical risks to documented exploits. ContextCrush, Unit42 sampling attacks, and cross-agent escalation prove the attack surface is real. Here is how gateway-level interception stops them. Wed, 18 Mar 2026 00:00:00 GMT Algis Dumbris security MCP exploits gateway tool-poisoning supply-chain https://mcpblog.dev/blog/2026-03-17-mcp-registry-guide https://mcpblog.dev/blog/2026-03-17-mcp-registry-guide MCP servers are scattered across GitHub repos, awesome-lists, and third-party directories. The Official MCP Registry changes that. Here's why registries matter, how the ecosystem fits together, and how to set up automatic publishing from your CI pipeline. Tue, 17 Mar 2026 00:00:00 GMT Algis Dumbris MCP registry CI/CD open-source developer-tools https://mcpblog.dev/blog/2026-03-16-deploy-agent-messaging-hub https://mcpblog.dev/blog/2026-03-16-deploy-agent-messaging-hub SynapBus is a single Go binary that gives your AI agent swarm Slack-like messaging, semantic search, and MCP connectivity. Deploy it with Docker or Kubernetes, expose it via Cloudflare Tunnel, and connect your first agents -- total cost: $0. Mon, 16 Mar 2026 00:00:00 GMT Algis Dumbris SynapBus MCP multi-agent deployment tutorial https://mcpblog.dev/blog/2026-03-15-a2a-v1-mcp https://mcpblog.dev/blog/2026-03-15-a2a-v1-mcp Google's Agent-to-Agent protocol just hit v1.0 under the Linux Foundation. Here is how A2A and MCP work together to enable the next generation of AI agent architectures. Sun, 15 Mar 2026 00:00:00 GMT Algis Dumbris A2A MCP agent-protocols multi-agent agentic-ai https://mcpblog.dev/blog/2026-03-15-owasp-mcp-top-10 https://mcpblog.dev/blog/2026-03-15-owasp-mcp-top-10 The OWASP MCP Top 10 maps the most critical security risks in AI agent tool integration — from tool poisoning to context poisoning. Here is what practitioners need to know. Sun, 15 Mar 2026 00:00:00 GMT Algis Dumbris security MCP OWASP tool-poisoning agentic-ai https://mcpblog.dev/blog/2026-03-13-mcp-filesystem-sandboxing https://mcpblog.dev/blog/2026-03-13-mcp-filesystem-sandboxing The MCP security landscape has evolved through three waves: protocol scanning, traffic proxying, and OS-level sandboxing. Here's the full map of projects and where the frontier is heading. Fri, 13 Mar 2026 00:00:00 GMT Algis Dumbris security MCP sandboxing agentic-ai https://mcpblog.dev/blog/2026-03-13-mcp-tool-annotations https://mcpblog.dev/blog/2026-03-13-mcp-tool-annotations The MCP spec includes five tool annotation fields that tell agents whether tools are read-only, destructive, or open-world. Most servers don't use them. Here's why that needs to change. Fri, 13 Mar 2026 00:00:00 GMT Algis Dumbris MCP tool-annotations security agentic-ai https://mcpblog.dev/blog/2026-03-08-nist-mcp-agent-identity https://mcpblog.dev/blog/2026-03-08-nist-mcp-agent-identity NIST's draft concept paper lists MCP as one of five standards under evaluation for agentic AI authentication. What this means for MCP's legitimacy and enterprise adoption. Thu, 12 Mar 2026 00:00:00 GMT Algis Dumbris governance NIST identity MCP standards https://mcpblog.dev/blog/2026-03-09-context-explosion-tool-discovery https://mcpblog.dev/blog/2026-03-09-context-explosion-tool-discovery Google quietly removed MCP from its Workspace CLI after tool definitions ballooned context windows to 100K tokens. The tool discovery problem is MCP's biggest scaling barrier. Thu, 12 Mar 2026 00:00:00 GMT Algis Dumbris tool-discovery MCP context-management BM25 https://mcpblog.dev/blog/2026-03-10-confused-deputy-mcp-auth https://mcpblog.dev/blog/2026-03-10-confused-deputy-mcp-auth MCP's authentication model has a fundamental gap: servers cannot verify whether an agent was authorized to use the credentials it presents. Here's why this matters and what's being done about it. Thu, 12 Mar 2026 00:00:00 GMT Algis Dumbris security OAuth authentication MCP https://mcpblog.dev/blog/2026-03-11-clinejection-anatomy https://mcpblog.dev/blog/2026-03-11-clinejection-anatomy A detailed breakdown of the Clinejection attack chain that compromised the Cline VS Code extension in January 2026, and what it reveals about trust boundary gaps in MCP composition. Thu, 12 Mar 2026 00:00:00 GMT Algis Dumbris security supply-chain MCP agentic-ai https://mcpblog.dev/blog/2026-03-12-state-of-mcp-security https://mcpblog.dev/blog/2026-03-12-state-of-mcp-security A comprehensive look at the security landscape of the Model Context Protocol ecosystem - from tool poisoning attacks to emerging defenses. Thu, 12 Mar 2026 00:00:00 GMT Algis Dumbris security MCP supply-chain tool-discovery agentic-ai