Reusable workshop materials, vulnerability catalog, and resource index for examining MCP security.
This is a fast-moving area. The MCP specification itself is evolving, the security guidance in the spec is being actively developed, and new tooling appears regularly. This document collects what exists today so you can evaluate it yourself. None of these materials are exhaustive. The landscape changes weekly, and new tools, vulnerabilities, and mitigations appear faster than any single resource can track.
Disclaimer: Inclusion of any project, product, or link here is not an endorsement. This is a landscape index. Evaluate everything independently.
Last reviewed: September 14, 2026.
Browse this content online: sammorrowdrums.github.io/mcp-security-workshop
github/github-mcp-server, originally passing the upstream testsThe walkthrough covers practical attack implementation. The vulnerability catalog covers the broader documented landscape. They are complementary: the walkthrough shows how easy it is to build attacks, the catalog shows the breadth of what has been found in the wild.
The protocol has gone through four major stable revisions through mid-2026, each changing its security surface:
Working-group structures change as proposals mature. Consult the live Working and Interest Groups index and roadmap for the current roster and priorities. For example, RFC 9207 issuer validation moved from active mix-up-protection work into the stable 2026-07-28 specification.
The vulnerability catalog provides detailed entries with MCP-specific enablers, mitigations, and primary sources.
Maintained and notable tools for inspecting MCP configurations, definitions, traffic, and agent setups. Status and descriptions were verified on September 14, 2026.
| Project | Description | Link |
|---|---|---|
| Snyk Agent Scan (formerly Invariant Labs mcp-scan) | Scans agent configurations and skills across Claude, Cursor, VS Code, Windsurf, Gemini CLI, and other hosts. Detects prompt injection, tool poisoning, tool shadowing, toxic flows, hardcoded secrets, and malicious skills | github.com/snyk/agent-scan |
| Cisco AI Defense MCP Scanner | Python-based scanner combining static rules, YARA and LLM analysis, dependency auditing, binary checks, and sandboxed package inspection | github.com/cisco-ai-defense/mcp-scanner |
| Trail of Bits mcp-context-protector | Security proxy between client and MCP servers. TOFU pinning of tool definitions, guardrail scanning, ANSI sanitization, quarantine for suspicious responses | github.com/trailofbits/mcp-context-protector |
| MCP Shark | Local scanner and traffic proxy for MCP IDE configurations, with static rules, YARA-based traffic analysis, SARIF/HTML/JSON reports, and optional cloud-backed Smart Scan. Source-available under a non-commercial license; not OSI-approved | github.com/mcp-shark/mcp-shark |
Running AI agents with unrestricted access to a machine is equivalent to running arbitrary code there. These projects provide isolation at different levels. Status and descriptions were verified on September 14, 2026.
| Project | Description | Platform | Link |
|---|---|---|---|
| NVIDIA OpenShell | Sandboxed execution environments for AI agents. Declarative YAML policies control filesystem, network, process, and inference access; an L7 proxy enforces HTTP method and path-level egress rules | Linux; macOS on Apple Silicon; Windows via experimental WSL2 support; experimental Kubernetes Helm chart | github.com/NVIDIA/OpenShell |
| SandVault | Lightweight sandbox using macOS user account isolation and sandbox-exec. No VM overhead. Designed for running Claude Code, Codex, and Gemini with their “skip permissions” flags in a limited user account | macOS | github.com/webcoyote/sandvault |
| jai (Stanford SCS) | Casual sandbox for AI agents on Linux. Prefix a command with jai to get a copy-on-write home overlay while keeping the working directory writable. Offers casual, strict, and bare modes; reduces everyday blast radius but is not a hardened container |
Linux | jai.scs.stanford.edu |
| ToolHive (Stacklok) | Enterprise platform for running MCP servers in isolated containers with secrets management, policy enforcement, OIDC/OAuth SSO, and audit logging. Includes a registry server, runtime, gateway, and portal | Linux (Docker/K8s) | github.com/stacklok/toolhive |
Additional general-purpose isolation options include Docker, Podman, bubblewrap, firejail, and virtual machines.
Platforms for hosting, connecting, managing, and governing MCP servers and agent runtimes. Status and descriptions were verified on September 14, 2026.
| Project | Description | Link |
|---|---|---|
| Obot | Open-source AI governance platform with MCP and LLM gateways, Docker/Kubernetes hosting, Git-backed MCP and skills registries, and Obot Sentry (beta) for device-level agent monitoring. Self-hosted, MIT-licensed | github.com/obot-platform/obot |
| ToolHive (Stacklok) | Open-source platform combining isolated MCP server runtimes with registry, gateway, secrets management, policy enforcement, and OIDC/OAuth integration | github.com/stacklok/toolhive |
| Cloudflare Agents SDK | Durable agent-runtime platform with state, sessions, and scheduling; MCP is available as a client-side tool integration for remote servers using OAuth, token authentication, or custom transport headers | developers.cloudflare.com/agents |
As agent configurations, skills, prompts, instructions, and MCP server references proliferate, managing and securing them becomes a supply-chain problem. Status and descriptions were verified on September 14, 2026.
| Project | Description | Link |
|---|---|---|
| Microsoft APM (Agent Package Manager) | Open-source dependency manager for agent configuration. Declares skills, prompts, instructions, hooks, plugins, and MCP servers in apm.yml; resolves transitive dependencies and scans packages before deployment. Supports GitHub Copilot, Claude Code, Grok Build, Cursor, OpenCode, Codex, Gemini, Windsurf, and Kiro. MIT-licensed |
microsoft.github.io/apm |
| Tessl | Package manager and registry for agent skills and context. Evaluates skills against structured benchmarks (measurable accuracy impact). Security scores powered by Snyk. Used by Cisco, HashiCorp/IBM | tessl.io |
Supply chain attacks against software ecosystems are not new, but the scale and speed are increasing. AI agent configurations, MCP server registries, and skill/plugin ecosystems introduce new supply chain surfaces that mirror problems seen in npm, PyPI, and container registries.
The npm maintainer account for axios was hijacked. Malicious versions 1.14.1 and 0.30.4 were published with a hidden dependency (plain-crypto-js) that dropped a cross-platform Remote Access Trojan. The malicious versions were live for approximately three hours. Platform-specific payloads targeted macOS, Windows, and Linux. This occurred amid a wave of npm supply-chain attacks in March 2026 that included a separate campaign (“TeamPCP”) targeting Trivy, Telnyx, and LiteLLM; researchers have not linked the axios compromise to that actor.
Representative MCP-specific supply-chain incidents include:
These are the same classes of problems that package ecosystems have faced for years (typosquatting, account takeover, dependency confusion, abandoned package hijacking), now appearing in agent and MCP server registries.
GitHub provides a set of security features that compose together to address supply chain risks. These are free for all public repositories:
These features work together: Dependabot pulls from the Advisory Database, secret scanning catches credentials that should never be in source, code scanning finds the bugs before they ship. For MCP server authors and consumers, this is baseline hygiene.
AI is increasingly used on the offensive side of security testing. This changes the economics of both attack and defense.
| Project | Description | Link |
|---|---|---|
| XBOW | Autonomous offensive security platform. Executes penetration tests at machine scale with exploit-validated findings (not theoretical risk). Validated on HackerOne finding real vulnerabilities in production applications. $120M Series C | xbow.com |
AI-driven offensive testing is now a practical reality. Autonomous reconnaissance, vulnerability identification, and exploit execution operate at a scale and speed that manual testing cannot match. The same capabilities inform the threat model for any agent-connected system.
As AI agents gain access to production data and infrastructure through MCP, the consequences of compromise extend beyond code execution into data integrity and recovery.
If you know of relevant tools, research, or resources that should be listed here, open an issue or PR. The goal is a useful, current index of the MCP security landscape. This list is not exhaustive and will never be. Additions, corrections, and updates are welcome.
