MCP Security Checklist: How to Vet and Run MCP Servers Safely in 2026
MCP is not safe by default. Twelve checks, by phase, for vetting an MCP server before install and constraining it at the call, in flight and on update.
Security
26 articles in this category.
Arcade's $60M Round Makes Agent Permissions Infrastructure
Arcade.dev raised $60M in June 2026 for an agent authorization layer. What scoped permissions, MCP tool policy and audit trails mean for your agent stack.
Agentjacking Turns MCP Tool Output Into an Execution Path
Agentjacking hijacks AI coding agents with a fake Sentry error. Tenet found 2,388 exposed orgs, 100+ agents running attacker code, an 85% success rate.
IETF MCP Draft Turns Tool Safety Into a Standards Problem
An IETF Internet-Draft names 6 recurring MCP vulnerability classes and states that the MCP specification defines no normative security requirements.
Runaway Agent AWS Bill Shows Tool Budgets Are Permissions
An AI agent provisioned five AWS instances to port-scan DN42 and ran up $6,531.30 in about 24 hours. Cost, scope and rate are tool permissions, not prompt text.
Agent Phishing Shows Why Tool Permissions Need Identity Checks
Varonis and Imperva tested OpenClaw agents in June 2026: 2 of 4 phishing scenarios leaked live secrets. Identity-bound tool permissions are the fix.
OpenClaw Shows Why Agents Need a Bill of Materials
An Agent Bill of Materials lists every skill, plugin, MCP server, credential and paired device an agent can reach. OpenClaw's ClawJacked bug is why you need one.
Cisco Cloud Control Makes Agent Tool Governance Mainstream
Cisco Cloud Control puts AI agents, MCP connectors and a 50-partner tool marketplace inside infrastructure operations. What admission control that now requires.
Vercel's Skills API Turns Agent Skills Into Infrastructure
Vercel's skills.sh API exposes 600,000+ agent skills to any tool holding an OIDC token. Pin the content hash, not the name, before you let an agent install one.
VIPER-MCP Shows Agent Tools Need Taint Scanning
VIPER-MCP scanned 39,884 MCP server repos and confirmed 106 zero-days, 67 with CVE IDs. Agent tools need code-level taint analysis, not trust prompts.
Microsoft ACS: Agent Controls Move Into the Runtime
Microsoft's Agent Control Specification evaluates agent policy at 8 intervention points and returns 1 of 5 verdicts: allow, warn, deny, escalate, transform.
NSA MCP Guidance: Inventory Agent Tools Before They Drift
The NSA's May 2026 MCP guidance treats agent tooling as infrastructure: inventory every server, verify tool changes, and scan before trust drifts.
Ruleset v2026.06.05: What 300 Sub-Agent Reviews Revealed
Ruleset v2026.06.05 adds five rules for a publisher family targeting ~/.claude and fixes eight noisy patterns. Stage 2 now reads ~6 findings per skill, not ~15.
MCP RCE Debate: Treat Agent Plugins Like Executable Code
OX Security found a remote code execution design flaw in MCP's official SDKs: 10 CVEs, 30+ disclosures, 7,000+ exposed servers. Treat MCP servers as code.
Open-OSS/privacy-filter: Typosquatting the AI Model Registry
A Hugging Face repo typosquatted OpenAI's Privacy Filter, hit #1 trending on 244K downloads in 18 hours, then ran a Rust infostealer. The full attack chain.
Claude Mythos Found Zero-Days Everywhere. Here's Your Playbook.
Claude Mythos Preview found zero-days in every major OS and browser, one of them 27 years old, for under $50 a bug. What defenders should change now.
ToxicSkills: What the First Large-Scale Agent Skill Audit Found
Snyk scanned 3,984 AI agent skills: 36.82% had a security flaw, 13.4% a critical one, 76 carried confirmed malware and 8 were still live at publication.
MCP Tool Poisoning: How Hidden Metadata Hijacks AI Agents
MCP tool poisoning hides attacker instructions in tool description metadata your model reads and your UI never shows. How it works, and how to detect it.
Langflow Exploited in 20 Hours: The AI Framework Attack Surface
Langflow's CVSS 9.3 unauthenticated RCE was exploited in the wild 20 hours after disclosure, with no public PoC. Three LangChain and LangGraph CVEs followed.
When Trusted Packages Turn Hostile: Cascading Supply Chain Attacks
TeamPCP hid a credential stealer in a WAV file inside telnyx 4.87.1 on PyPI, using tokens stolen from litellm three days earlier. Why the cascade evades review.
Is It Safe to Install Claude Code Skills? How to Check One First
Claude Code skills run with your files, shell and credentials. ClawHavoc put 1,184 malicious skills in one registry. How to check one before you install.
LiteLLM's PyPI Backdoor: What It Means for the AI Skill Supply Chain
TeamPCP pushed a credential stealer into litellm 1.82.7 and 1.82.8 on PyPI via a compromised Trivy action. What it did, and why AI skills are next.
SkillJect and the Gap in Skill Registry Security
SkillJect poisons agent skills and averages 80.7% attack success on Claude Code. Four skill scanners caught it 61.5% of the time. The 4 rules we shipped.
ClawHavoc Campaign Explained: 1,184 Malicious AI Agent Skills
ClawHavoc was a January 2026 poisoning campaign on ClawHub: 1,184 malicious agent skills from 12 author IDs, most delivering the AMOS macOS stealer.
Why Scanning Architecture Matters: Comparing Skill Registry Security
Three registry security models - reactive moderation, install-time scanning, and dual-side verification with a tree hash - and the attack each one misses.
How Dual-Side Verification Protects Against Supply Chain Attacks
Dual-side verification scans a shared AI skill twice, once by the publisher and once by you, then compares both reports and a SHA-256 tree hash before install.