AID-H-034: MCP Server Runtime Boundary & Tool Exposure Governance
Harden the MCP server as an independent trust boundary that publishes tools, resources, prompts, multi-round-trip input requests, extension tasks, MCP Apps, and backend integrations. The supported baseline is MCP v2
Coverage includes:
Release gate: pin exact MCP v2
2026-07-28: each Streamable HTTP request is self-contained, the initialize lifecycle and session ID are absent, routing headers match the JSON-RPC body, required per-request metadata carries protocol version and client capabilities, optional clientInfo carries self-reported client name and version when supplied, and application state uses explicit authorized handles.Coverage includes:
- Deployment profile, stdio and Streamable HTTP transport, Origin, protocol/header validation, TLS, runtime, and coarse abuse baseline.
- OAuth protected-resource behavior, issuer and audience validation, progressive scope minimization, no token passthrough, and confused-deputy prevention.
- Validation and authorization before handlers, reads, prompts, backend calls, filesystem access, command execution, database queries, or network fetches.
- Signed publication contracts, JSON Schema 2020-12,
ttlMs/cacheScope, extension negotiation, and MCP App declarations. - Output, resource URI, explicit handles, Tasks/subscriptions, authoritative operation-budget integration, protocol-specific replay safeguards, and signed disable-state enforcement.
Release gate: pin exact MCP v2
2026-07-28 sources and conformance fixtures. Reject any request whose declared version differs, and prove forbidden handshake methods or session headers cannot create state.Scope boundary
Owns MCP server protocol and handler enforcement: deployment and transport baseline, OAuth resource semantics, backend authorization, publication, output, explicit application handles, task and subscription isolation, operation-budget integration, and authoritative disable-state checks.
AID-H-028: AID-H-034 owns the MCP server and its backend boundary; AID-H-028 owns the client host, local credentials, rendering, client cache and state, user input flow, and client distribution. Each side must enforce the state and decisions it controls.
AID-H-018: AID-H-034 enforces authorization after a request reaches the MCP server; AID-H-018 defines and enforces the agent or orchestrator's capability policy before and during action execution. Server-side authorization remains mandatory even for an approved agent request.
AID-H-024: AID-H-034 governs what the server publishes and executes; AID-H-024 verifies consuming-side resolution of server, tool, descriptor, and contract identity. A correctly hardened server does not prevent a client from resolving the wrong server.
AID-D-005.001: AID-H-034 emits protocol and enforcement events at server handlers; AID-D-005.001 owns security telemetry generation contracts, collection, completeness, and durable observability across the AI system. The server must provide events but must not claim end-to-end telemetry coverage.
AID-H-004.005: AID-H-034 owns MCP-specific transport, OAuth, request and handle authorization, Tasks, subscriptions, budget hooks, idempotency boundaries, and disable-state enforcement; AID-H-004.005 owns a generic signed-envelope freshness and replay discipline across untrusted intermediaries. MCP-specific mechanisms remain in AID-H-034 and do not amount to universal end-to-end message protection.
Warning
Emerging MCP Server Attack Surface
MCP server security is a rapidly evolving production risk area.
- Generic web security is not enough: secure MCP operation also requires per-request protocol metadata, routing-header/body agreement, extension negotiation, cache-scope correctness, multi-round-trip input binding, JSON Schema 2020-12 limits, and model-visible contract integrity.
- MCP v2 2026-07-28 is self-contained: do not recreate
Mcp-Session-Id, sticky routing, initialize state, or a hidden global client session. Applications may use explicit opaque handles only when they are object-authorized, tenant-bound, expiring, and independently revocable. - Deprecated capabilities in MCP v2 2026-07-28: enable roots, sampling, or logging only as explicitly approved deprecated-capability exceptions with method-specific budgets, telemetry, and disable controls.
Sub-techniques
- AID-H-034.001: MCP Server Deployment Profile, Transport & Exposure Baseline
- AID-H-034.002: MCP Server OAuth Resource Boundary & Delegation Safety
- AID-H-034.003: Server-Side Tool Invocation Validation & Object-Level Authorization
- AID-H-034.004: MCP Tool, Resource & Prompt Publication Governance
- AID-H-034.005: MCP Server Output, Resource URI & Elicitation Boundary Controls
- AID-H-034.006: MCP Server Explicit Application-Handle Isolation
- AID-H-034.007: MCP Task & Subscription Lifecycle Isolation
- AID-H-034.008: MCP Operation Budget Enforcement Integration
- AID-H-034.009: MCP Server Authoritative Disable-State & Commit-Fence Integration
Threat mappings
MITRE ATLAS
- AML.T0010 AI Supply Chain Compromise
- AML.T0010.005 AI Supply Chain Compromise: AI Agent Tool
- AML.T0011 User Execution
- AML.T0011.002 User Execution: Poisoned AI Agent Tool
- AML.T0012 Valid Accounts
- AML.T0029 Denial of AI Service
- AML.T0034.002 Cost Harvesting: Agentic Resource Consumption
- AML.T0049 Exploit Public-Facing Application
- AML.T0051 LLM Prompt Injection
- AML.T0053 AI Agent Tool Invocation
- AML.T0072 Cyber Communication Channel
- AML.T0074 Masquerading
- AML.T0086 Exfiltration via AI Agent Tool Invocation
- AML.T0098 AI Agent Tool Credential Harvesting
- AML.T0101 Data Destruction via AI Agent Tool Invocation
- AML.T0105 Escape to Host
- AML.T0110 AI Agent Tool Poisoning
- AML.T0110.000 AI Agent Tool Poisoning: Definition and Instructions
- AML.T0110.002 AI Agent Tool Poisoning: Runtime Response
- AML.T0115 Publish Poisoned AI Artifacts
- AML.T0115.002 Publish Poisoned AI Artifacts: AI Agent Tools
- AML.T0122 Exploitation of Remote Services
- AML.T0132 Misconfigured or Publicly Exposed AI Services
MAESTRO
- Denial of Service (DoS) Attacks (L1)
- Data Exfiltration (L2)
- Denial of Service (DoS) Attacks (L4)
- Agent Identity Attack (L7)
- Agent Tool Misuse (L7)
- Integration Risks (L7)
- Compromised Agent Registry (L7)
- Supply Chain Attacks (Cross-Layer)
OWASP LLM Top 10 2026
- LLM01:2026 Prompt Injection
- LLM02:2026 Sensitive Information Disclosure
- LLM03:2026 Excessive Agency
- LLM06:2026 Unbounded Consumption
- LLM08:2026 Hidden Context Exposure
- LLM10:2026 Improper Output Handling
OWASP ML Top 10 2023
- ML06:2023 AI Supply Chain Attacks
- ML09:2023 Output Integrity Attack
OWASP Top 10 for Agentic Applications 2026
- ASI02:2026 Tool Misuse and Exploitation
- ASI03:2026 Identity and Privilege Abuse
- ASI04:2026 Agentic Supply Chain Vulnerabilities
- ASI05:2026 Unexpected Code Execution (RCE)
- ASI07:2026 Insecure Inter-Agent Communication
- ASI08:2026 Cascading Failures
- ASI10:2026 Rogue Agents
NIST Adversarial Machine Learning 2025
- NISTAML.014 Energy-latency
- NISTAML.015 Indirect Prompt Injection
- NISTAML.036 Leaking information from user interactions
- NISTAML.039 Compromising connected resources
Cisco Integrated AI Security and Safety Framework
- AITech-1.2 Indirect Prompt Injection
- AITech-2.1 Excessive Agency
- AITech-2.2 Goal Drift
- AITech-4.2 Context Boundary Attacks
- AITech-4.3 Protocol Manipulation
- AITech-7.4 Token Manipulation
- AITech-8.2 Data Exfiltration / Exposure
- AITech-8.3 Information Disclosure
- AITech-9.1 Model or Agentic System Manipulation
- AITech-9.3 Dependency / Plugin Compromise
- AITech-12.1 Tool Exploitation
- AITech-12.2 Insecure Output Handling
- AITech-13.1 Disruption of Availability
- AITech-13.2 Cost Harvesting / Repurposing
- AITech-14.1 Unauthorized Access
- AITech-14.2 Abuse of Delegated Authority
- AITech-16.1 Eavesdropping
- AISubtech-2.1.1 Execution Approval Bypass
- AISubtech-2.1.2 Capability and Permission Overreach
- AISubtech-2.2.3 Authorization and Constraint Erosion
- AISubtech-4.2.2 Session Boundary Violation
- AISubtech-4.3.1 Schema Inconsistencies
- AISubtech-4.3.3 Server Rebinding Attack
- AISubtech-4.3.4 Replay Exploitation
- AISubtech-4.3.5 Capability Inflation
- AISubtech-4.3.6 Cross-Origin Exploitation
- AISubtech-7.4.1 Token Theft
- AISubtech-8.2.3 Data Exfiltration via Agent Tooling
- AISubtech-8.3.2 System Information Exposure
- AISubtech-8.3.3 Personally Identifiable Information Exposure
- AISubtech-8.3.4 Payment Card Industry Data Exposure
- AISubtech-8.3.5 Protected Health Information Exposure
- AISubtech-9.1.3 Unauthorized or Unsolicited Network Access
- AISubtech-9.1.4 Injection Attacks (e.g., SQL, Command Execution, XSS)
- AISubtech-9.3.1 Malicious Package / Tool Injection
- AISubtech-9.3.2 Dependency Name Squatting (Tools / Servers)
- AISubtech-9.3.3 Dependency Replacement / Rug Pull
- AISubtech-12.1.1 Parameter Manipulation
- AISubtech-12.1.2 Tool Poisoning
- AISubtech-12.1.3 Unsafe System / Browser / File Execution
- AISubtech-13.1.1 Compute Exhaustion
- AISubtech-13.1.2 Memory Flooding
- AISubtech-13.1.3 Model Denial of Service
- AISubtech-13.1.4 Application Denial of Service
- AISubtech-13.2.1 Service Misuse for Cost Inflation
- AISubtech-14.1.2 Insufficient Access Controls
- AISubtech-14.2.1 Permission Escalation via Delegation
- AISubtech-18.2.1 Abuse of APIs for Mass Automation
Google Secure AI Framework 2.0 - Risks
- EDH: Excessive Data Handling
- DMS: Denial of ML Service
- IIC: Insecure Integrated Component
- PIJ: Prompt Injection
- SDD: Sensitive Data Disclosure
- RA: Rogue Actions
Databricks AI Security Framework 3.0
- Model Serving - Inference requests 9.7: Denial of Service (DoS)
- Agents - Tools MCP Server 13.16: Prompt Injection
- Agents - Tools MCP Server 13.17: Confused Deputy
- Agents - Tools MCP Server 13.18: Tool Poisoning
- Agents - Tools MCP Server 13.19: Credential and Token Exposure
- Agents - Tools MCP Server 13.20: Insecure Server Configuration
- Agents - Tools MCP Server 13.21: Supply Chain Attacks
- Agents - Tools MCP Server 13.22: Excessive Permissions and Scope Creep
- Agents - Tools MCP Server 13.23: Data Exfiltration
- Agents - Tools MCP Server 13.24: Context Spoofing and Manipulation
- Agents - Tools MCP Server 13.25: Insecure Communication