Research Notes — MCP Server Security Standard v0.1#

This document summarizes the research sources, patterns, and claims used to inform the MSSS v0.1 controls.

Sources#

Official MCP Documentation#

OWASP & Industry Frameworks#

Academic Research#

Vulnerability Reports#

Security Research & Best Practices#

Repeated Failure Patterns by Domain#

FS — Filesystem & Local Resources#

• Naive prefix matching: Path validation using startswith() without canonical path resolution
• Symlink bypass: Validating requested path but not resolving symlink targets before access
• Insecure glob patterns: Unrestricted glob expansion allowing access outside intended directories
• Missing size limits: No bounds on file reads leading to memory exhaustion

EXEC — Command Execution#

• Shell string concatenation: Using os.system() or shell=True with user-controlled input
• Missing argument separators: Not using -- to separate options from user-supplied arguments
• Over-broad command allowlists: Including commands that can invoke shells (git, find, etc.)

NET — Network Access#

• SSRF via unrestricted fetch: Tools fetching arbitrary URLs including internal services and cloud metadata
• Blacklist-based validation: Using deny lists instead of explicit allowlists for URL validation
• Missing egress controls: No network policy restricting outbound connections
• DNS rebinding: Validating hostname before fetch but not after resolution

AUTHZ — Authorization#

• Missing OAuth delegation: Using shared server credentials instead of per-user tokens
• Over-permissioned tools: Tools with blanket read/write access instead of scoped permissions
• No RBAC implementation: All users/clients get the same access level
• Hardcoded credentials: API keys and database passwords in source code or config files

INPUT — Input Validation#

• Schema-less tools: Accepting arbitrary JSON without schema validation
• Unbounded arrays/strings: No limits on collection sizes or string lengths
• Missing timeouts: Long-running operations without cancellation mechanisms
• ReDoS patterns: Regular expressions with catastrophic backtracking

LOG — Logging & Audit#

• Secrets in logs: Logging API keys, tokens, or passwords in plaintext
• Missing attribution: Unable to trace actions to specific users
• Insufficient invocation logging: Not recording tool calls, arguments, or results

SUPPLY — Supply Chain#

• No package signing: Distributing MCP servers without cryptographic signatures
• Typosquatting: Malicious packages with names similar to legitimate ones
• Rug pulls: Legitimate-appearing packages that change behavior after trust is established
• Unpinned dependencies: Using floating versions without hash verification

DEPLOY — Deployment Hardening#

• Running as root: Container processes with UID 0
• Docker socket mounting: Exposing host Docker control to container
• Missing seccomp/AppArmor: No syscall filtering or MAC policies
• Writable root filesystem: Allowing persistent modifications
• No resource limits: Unbounded CPU/memory consumption

Claims to Verify#

The following claims from research sources require independent verification before citing as fact:

UNVERIFIED — Statistics#

UNVERIFIED — CVE Details#

UNVERIFIED — Future Claims#

Notes for Control Development#

1. Do not cite unverified statistics in control rationale. Use qualitative statements instead (e.g., “commonly observed” rather than “43% of servers”).

2. CVEs with NVD entries may be referenced as concrete examples of vulnerability patterns.

3. Academic papers should be cited for taxonomy and attack methodology but not for prevalence statistics without verification.

4. OWASP MCP Top 10 is a living document and may change; reference the specific version when citing.

5. Transport-agnostic controls are preferred; transport-specific guidance belongs in profiles or appendices.