Skip to content

MCP security coverage & crosswalk

The corpus study is research/state-of-mcp-2026/REPORT.md (v1.0, citable). This page is not a second report and does not restate its findings. It covers what only lives here: the framework crosswalk generated from the committed rule registry, the dated evidence anchors, and the reserved-surface status table for MCP final 2026-07-28.

Regenerate the coverage data with python -c "from agent_audit_kit.output.coverage_map import render_json; open('docs/coverage.json','w').write(render_json())".

AgentAuditKit ships 362 deterministic rules, each mapped — rule by rule — to the framework control it evidences. The full, machine-readable crosswalk is docs/coverage.json; the live per-framework counts (severity, OWASP MCP Top-10, OWASP Agentic Top-10 2026, NSA MCP CSI, EU AI Act, CVEs covered) come from there so this doc never drifts.

Coverage, mapped to frameworks

agent-audit-kit --emit-coverage --format md    # human table
agent-audit-kit --emit-coverage --format json  # == docs/coverage.json

Every rule carries: id, title, severity, the CVE(s) it covers, its OWASP MCP Top-10 (2025) slot, its OWASP Agentic Top-10 (2026) slot, the NSA MCP Security CSI control (U/OO/6030316-26, 2026-05-20) it evidences, and the EU AI Act article it maps to. docs/coverage.json groups and counts by each framework. The NSA-CSI + OWASP-Agentic view is also in docs/crosswalk/nsa-csi-owasp-agentic.md.

Corpus findings live in the report

The data run over 2,303 distinct public MCP server configs — a GitHub crawl plus the official MCP Registry's latest-version servers, deduped by content — is published in full as research/state-of-mcp-2026/REPORT.md (v1.0, with methods, limitations and a citation block), over the raw results.json. Per-rule prevalence is in PREVALENCE.md.

One figure for orientation, generated from the same data: 52.1% (1,201/2,303) of those configs declare a remote server with no authentication. Everything else — grade distribution, auth-posture and transport splits, the top misconfigurations table — is in the report, and is deliberately not duplicated here. This page previously carried a stubbed "what breaks" section that competed with it; that is what let 100% (421/421) sit on this page while the report said 424.

Evidence anchors (verified live 2026-07-24)

  • MCP final spec, 2026-07-28 — the largest revision since launch: stateless core (removes initialize + Mcp-Session-Id), per-request _meta metadata transport, MCP Apps (server-rendered HTML in a sandboxed iframe), the Tasks extension (tool calls answered with task handles), and full JSON Schema 2020-12 tool schemas. Key Changes.
  • NSA MCP Security CSI — Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation, U/OO/6030316-26 (NSA AISC, 2026-05-20). All 9 recommendation sections are crosswalked in docs/coverage.json.
  • CVE-2026-35394 — mobile-mcp < 0.0.50: mobile_open_url passes a caller-supplied URL to Android's intent system with no scheme validation → arbitrary intents (USSD, calls, SMS, content-provider access). NVD 8.8 HIGH. Fixed 0.0.50.
  • CVE-2026-25536 — @modelcontextprotocol/sdk (TypeScript) 1.10.0–1.25.3: cross-client response-data leak when one Server/transport instance is reused across connections (stateless StreamableHTTPServerTransport). NVD 7.1 HIGH. Fixed 1.26.0.
  • CVE-2026-12957 — Amazon Q Developer auto-loaded .amazonq/mcp.json from an opened repository and launched its MCP servers with the developer's full environment → code execution + AWS credential theft (Wiz, 2026-06-26). CVSS 8.5; fixed in language server 1.65.0 (adds a consent prompt). AAK already scans .amazonq/mcp.json for exactly this untrusted-config class.

(Deliberately not anchored: CVE-2026-65056 — not NVD-verifiable as of the 2026-07-23 triage note.)

2026-07-28 MCP-final surfaces — crosswalk status

The crosswalk reserves a slot for each 2026-07-28 surface so a rule slots in without a schema change. Slots and their live status are in docs/coverage.json → reserved_surfaces_2026_07_28:

Surface Reference Status
Stateless _meta-per-request MCP final 2026-07-28 (metadata transport) reserved (no rule yet)
MCP Apps sandboxed iframes SEP-1865 covered (AAK-MCP-APPS-001/002)
Tasks handles SEP-2663 covered (AAK-TASKS-001..004)
JSON-Schema-2020-12 tool schemas MCP final 2026-07-28 reserved (no rule yet)

No rules are invented for the reserved surfaces here — the slots are reserved so the crosswalk is ready when detection lands.