Top MCP security resources — August 2026

What it is

The Azure DevOps MCP confused-deputy bug and the specification's RFC 9207 fix are both already in the summary, but the page adds specifics the summary drops: concrete grep patterns for scan detection, the exact SANS numbers, and per-item authorship on the research cluster (ChainWatch, SPELLSMITH, MTGuard, AIP-Bench) that clarifies how they relate to each other rather than just listing them.

How it works

ChainWatch and MTGuard are complementary, not competing: MTGuard analyzes individual tool calls (static + dynamic), while ChainWatch's Hidden Markov Model targets the malicious sequence assembled from calls that are each individually benign — the specific gap every per-call defense misses by construction. SPELLSMITH is a deliberate workaround, not a fix: because taint-style flaws in MCP servers need real code changes and get fixed slowly, it embeds security guidance into tool descriptions to steer the agent away from unsafe arguments at the description layer instead of patching the server.

Preconditions / Affected

The SANS ISC telemetry is from one modest web host over 14 days: ~200 requests from 49 distinct source IPs hunting MCP servers, LLM endpoints, and agent configuration files — the page frames this as agent infrastructure joining .env and Spring Boot actuators as routine internet scanning noise, not a targeted campaign.

What to do

Two concrete, verbatim detections from the page:

grep for: POST /mcp
grep for: HEAD requests against /.claude/.credentials.json

Also: confirm from an external network that no agent configuration file (e.g. mcp.json) is reachable from a web root, and check whether /v1/models or /api/tags answers unauthenticated requests. The page frames this as the cheap, do-today step, distinct from the spec-upgrade work (DCR inventory, RFC 9207 issuer validation, gateway deployment) already in the existing summary.

Caveats

The page states the policy-enforcement gateway's effectiveness is "a separate question" from standing it up — it explicitly says the way to answer whether it holds is through MCP red teaming, not through deploying it alone.