MCP 2026-07-28 security surfaces and matching controls
untrusted inputs
metadata poisoning
descriptions and annotations
steer model or user
descriptor rug pull
name, schema, or behavior
changes after approval
route confusion
duplicate name or header
and body mismatch
capability escalation
compatibility declaration
mistaken for permission
MRTR state tampering
change arguments, forge confirmation,
or replay requestState
identity confusion
clientInfo, serverInfo, or display
name treated as authenticated proof
independent controls
scan + full digest
review first version, then
quarantine every change
qualified names
notes.search and issues.search
never silent overwrite
wire equality
version, method, and name
validated before policy
real authorization
issuer, principal, resource,
tool, scope, arguments
protected requestState
integrity, exact arguments, expiry,
principal, purpose, nonce
stateless policy keys
rate limit and audit by principal,
issuer, resource, tool, and time
No single control proves safety. Each closes a different ambiguity.