Website: modelcontextprotocol-security.io

A comprehensive security resource for Model Context Protocol (MCP) deployments, providing hardening guidance, operational best practices, and security tools for organizations using MCP servers and AI agents.

This is a Cloud Security Alliance (CSA) Community Project focused exclusively on the security aspects of Model Context Protocol implementations. While the main modelcontextprotocol.io site provides technical documentation and implementation guidance, this security-focused companion site addresses the critical security challenges that arise when deploying MCP in production environments.

• Why MCP Security? - Executive briefings on MCP security risks and business value
• Hardening Guide - 10-part comprehensive security framework
• Operations Guide - Production deployment best practices
• Reference Patterns - Proven secure architecture templates

• Security TTPs - Comprehensive database of MCP security tactics, techniques, and procedures
• TTP Matrix View - Interactive matrix interface for browsing all security techniques
• Known Vulnerabilities - CVE database and security advisories
• Audit Tools - Security assessment utilities and procedures

• Community Projects - Open-source MCP security tool ecosystem
• Tools & Scripts - Security automation and monitoring utilities

• GitHub Discussions - Security discussions and Q&A
• Working Group Meetings - Bi-weekly technical sessions
• Community Guidelines - How to contribute and collaborate

This documentation hub is part of a comprehensive security ecosystem:

• modelcontextprotocol-security.io - This website and documentation hub

• mcpserver-audit - MCP Security Expert for risk assessment and security evaluation
• mcpserver-finder - MCP Discovery Expert for finding and evaluating servers
• mcpserver-builder - MCP Development Expert for secure server development
• mcpserver-operator - MCP Operations Expert for secure deployment

• vulnerability-db - Comprehensive vulnerability database with CVE tracking
• audit-db - Community audit results and security assessments

All projects are actively maintained and available under open-source licenses.

Model Context Protocol enables AI agents to interact with external systems, APIs, and data sources. This powerful capability introduces significant security challenges:

• Privilege Escalation: AI agents may gain unintended access to sensitive systems
• Data Exposure: Sensitive information can be compromised through inadequate controls
• Supply Chain Risks: Third-party MCP servers may introduce vulnerabilities
• Operational Security: Production deployments require robust security measures

Recent security research has highlighted critical vulnerabilities in MCP tools, making security guidance essential for safe production deployment.

1. Understand the Risks: Start with Why MCP Security?
2. Assess Current Deployments: Use MCP Security Expert for risk assessment
3. Review Threat Landscape: Explore the TTP Matrix View
4. Check Vulnerabilities: Review Known Vulnerabilities

1. Secure Development: Use MCP Development Expert
2. Follow Best Practices: Implement controls from our Hardening Guide
3. Use Reference Patterns: Deploy proven architectures from Reference Patterns

1. Secure Deployment: Use MCP Operations Expert
2. Operational Security: Follow our Operations Guide
3. Find Secure Servers: Discover vetted servers with MCP Discovery Expert

We welcome contributions from security professionals, developers, and organizations using MCP:

• Join Discussions: Share experiences in GitHub Discussions
• Improve Documentation: Enhance security guides with real-world examples
• Develop Security Tools: Contribute to our open-source tool ecosystem
• Report Vulnerabilities: Submit findings to our vulnerability database
• Share Audit Results: Contribute to the community audit database
• Expand TTPs: Help document new attack techniques and defenses

• Questions: Use GitHub Discussions
• Issues: Report problems via GitHub Issues
• Working Group: Join our bi-weekly meetings (check Events)

This site is built with Jekyll and can be run locally:

# Navigate to the docs directory
cd docs/

# Run setup (installs dependencies)
./setup.sh

# Start development server
./serve.sh

# Visit http://localhost:4000

See docs/README.md for detailed development instructions.

This documentation website is released under CC0-1.0 (Creative Commons). Individual tools in the MCP Security ecosystem use Apache-2.0 licenses. See individual repository README files for specific licensing details.

This project is sponsored by the Cloud Security Alliance (CSA) and maintained by the Model Context Protocol Security Working Group.

Join our community: GitHub Discussions • Slack #mcp channel • Contribute on GitHub

Start securing your MCP deployment today at modelcontextprotocol-security.io