Vetting and Rug Pull Protection for Third-Party MCP Servers in Enterprise Agent Pipelines
MCP servers can turn malicious after approval, exploiting how trust binds to names, not behavior.
Priya Subramaniam
Section
MCP Security
10 stories in MCP Security.
Credential Rotation and Secret Expiry in Running MCP Agents
Long-lived MCP agents hold secrets far longer than stateless APIs were designed to manage.
Tobias Wrenfield
RBAC vs ABAC vs PBAC for MCP Access Control
Organizations must choose between RBAC, ABAC, and PBAC to fill MCP's missing authorization layer.
Marcus Delacroix-Ng
OWASP Top 10 for LLMs Applied to MCP Deployments
MCP's runtime tool discovery rewrites how OWASP's LLM risks actually happen.
Marcus Delacroix-Ng
MCP Server Identity Spoofing and Impersonation Attacks
Unverified server registries and weak identity checks open MCP systems to impersonation at scale.
Marcus Delacroix-Ng
Data Exfiltration Risks in Agentic MCP Pipelines
Legitimate agent tool calls expose sensitive data when servers lack authentication and verification.
Tobias Wrenfield
Lateral Movement via Compromised MCP Servers
Compromised MCP servers become pivot points for attackers across entire agent sessions.
Tobias Wrenfield
Supply Chain Risk in Third-Party MCP Servers
Enterprises are running unvetted third-party servers that scanners can't actually inspect.
Camille Osei-Bonsu
MCP Server Authentication Methods Compared
Most MCP teams chose the easiest method, not the safest one.
Tobias Wrenfield
Prompt Injection Attacks Targeting MCP Tool Calls
Attackers can hijack AI agents by hiding malicious instructions in tool descriptions and content.
Priya Subramaniam