Security Best Practices — MCP 2026-07-28
Versioned protocol guidance for authorization, token handling, SSRF and local-server risks. Start here when implementing an MCP service.
AI SECURITY RESOURCE DIRECTORY
AI security.
Sources & guides.●
Find research, practical guides, and source websites on prompt injection, MCP, agent security, and related topics.
— sources— selected readings— topics
Search by keyword, topic, or publisher.
Links to original publishers.
THE DIRECTORY
Browse resources
Results could not refresh. Previous results are still shown.
Model Context Protocol documentation
The protocol maintainers’ documentation is the starting point for MCP authorization requirements and transport security behavior.
MCP Security Cheat Sheet
A practical review checklist for MCP trust boundaries, authentication, tool access and deployment controls. Pair it with the protocol specification.
OWASP GenAI Security Project
Community security guidance, risk taxonomies and implementation resources. Use the stated edition when comparing framework entries.
Jumping the line: How MCP servers can attack you before you ever use them
Trail of Bits demonstrates how malicious tool descriptions can influence an agent before invocation. A useful threat-modeling case study.
MCP Security Testing Guide
Tool-vendor recipes for testing MCP integrations, including tool poisoning and data-exfiltration scenarios. Adapt the examples to your deployment.
Promptfoo red teaming documentation
Practical testing recipes and open-source tooling documentation from the tool vendor, useful for constructing repeatable application evaluations.
Trail of Bits AI and machine learning research
Original vulnerability research and audit engineering from a commercial security firm, with technical examples and project links.
Inside 90 days of attacks on AI infrastructure
Wiz reports observations from its AI-service honeypots, including exposed MCP services. Treat the telemetry as this vendor’s sampled observations.
OWASP Cheat Sheet Series
OWASP application-security guides, including MCP, AI agent security and prompt injection. Each cheat sheet links practical controls and further references.
No matching resources
Try another keyword or clear your filters.
Newest sorts by original publication date. Resources without a date appear last.
Directory updated
MCP ACCESS
Search these resources
from your agent.
Get source links, topic tags, and dates when available.