MCP.md

Model Context Protocol (MCP) Resources

References

• https://modelcontextprotocol.io/

  • https://modelcontextprotocol.io/docs/getting-started/intro
  • https://modelcontextprotocol.io/specification/
    • https://modelcontextprotocol.io/specification/2025-06-18
    • The 2026-07-28 Specification
      • https://blog.modelcontextprotocol.io/posts/2026-07-28/
      • https://modelcontextprotocol.io/specification/2026-07-28/architecture
      • https://modelcontextprotocol.io/docs/2026-07-28/getting-started/intro
      • https://github.com/modelcontextprotocol/modelcontextprotocol/tree/main/schema/2026-07-28
        • https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/schema/2026-07-28/schema.ts

• https://github.com/modelcontextprotocol/modelcontextprotocol

• https://github.com/modelcontextprotocol/registry

  • https://github.com/modelcontextprotocol/registry/tree/main/docs

MCP Servers

• https://github.com/IBM/mcp
  • A collection of Model Context Protocol (MCP) servers, clients and developer tools by IBM.

Authentication

• SEP-646: Enterprise-Managed Authorization Profile for MCP

  • modelcontextprotocol/modelcontextprotocol#646
    • https://aaronparecki.com/2025/05/12/27/enterprise-ready-mcp
  • proposal from Aaron Parecki for Model Context Protocol - Enterprise Authorization Profile.
    • https://www.linkedin.com/posts/activity-7343343090356600832-s_wF

• Spec Proposal: A Gateway-Based Authorization Model

  • modelcontextprotocol/modelcontextprotocol#804

Security

Security: Authentication

Security: Risks

• OWASP MCP Top 10
  • https://owasp.org/www-project-mcp-top-10/

Security: Articles

• The State of MCP Security

  • https://www.pynt.io/blog/llm-security-blogs/state-of-mcp-security

• MCP Horror Stories: The Security Issues Threatening AI Infrastructure

  • https://www.docker.com/blog/mcp-security-issues-threatening-ai-infrastructure/

• Advanced Tool Poisoning Attack (ATPA), Poison everywhere: No output from your MCP server is safe

  • https://www.cyberark.com/resources/threat-research-blog/poison-everywhere-no-output-from-your-mcp-server-is-safe

• Maia Iyer, Hybrid Cloud Research Software Engineer at IBM. (LinkedIn, (Medium.com))

  • Security in and around MCP: Part 1 — OAuth in MCP
    • https://medium.com/kagenti-the-agentic-platform/security-in-and-around-mcp-part-1-oauth-in-mcp-3f15fed0dd6e
  • Security In and Around MCP: Part 2 — MCP in Deployment
    • https://medium.com/kagenti-the-agentic-platform/security-in-and-around-mcp-part-2-mcp-in-deployment-65bdd0ba9dc6
  • Security in and around MCP: Part 3 — MCP Server Identity
    • https://medium.com/kagenti-the-agentic-platform/security-in-and-around-mcp-part-3-mcp-server-identity-10d6768d96c1

Security: Papers

• Bridging AI and Software Security: A Comparative Vulnerability Assessment of LLM Agent Deployment Paradigms

  • https://arxiv.org/abs/2507.06323

• From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows

  • https://arxiv.org/abs/2506.23260

Security: Vulnerabilities

• CVE-2025-6514: OS command injection in mcp-remote when connecting to untrusted MCP servers
  • https://www.cve.org/CVERecord?id=CVE-2025-6514
  • https://nvd.nist.gov/vuln/detail/CVE-2025-6514
  • Critical mcp-remote Vulnerability Enables Remote Code Execution, Impacting 437,000+ Downloads
    • https://thehackernews.com/2025/07/critical-mcp-remote-vulnerability.html

YouTube Videos

YouTube: Microsoft Developer Channel

• MCP Dev Days: Day 1 - DevTools
  • https://www.youtube.com/watch?v=8-okWLAUI3Q

Suggested Books

Interesting Articles

2025

• Easy, Secure Dynamic Client Registration for MCP & AI Agents
  • https://tailscale.com/blog/dynamic-client-registration-dcr-for-mcp-ai
  • Re: https://www.linkedin.com/feed/update/urn:li:ugcPost:7402036921532633088/?dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287402038232601038848%2Curn%3Ali%3AugcPost%3A7402036921532633088%29