The MCP ecosystem produced more than 40 CVEs between January and April 2026 — a cadence of roughly one every four days. The NSA published design-considerations guidance in May 2026. OWASP maintains a dedicated Top 10. What still does not exist is the piece that made cloud security operational: a baseline of verifiable items, each with a check command and an expected value.
As an exercise, this is the skeleton I would write.
Section 1 — Exposure and transport
- HTTP-transport servers MUST NOT listen on 0.0.0.0 without authentication. Check: bind address and presence of token validation.
- stdio servers MUST NOT receive configuration parameters concatenated into a shell. That is precisely the pattern OX Security identified in the official SDKs in April 2026, affecting Python, TypeScript, Java and Rust.
- Processes accepting untrusted input MUST NOT be able to reach the cloud metadata endpoint.
Section 2 — Authentication and identity
- Every remote server MUST publish Protected Resource Metadata (RFC 9728) and validate token audience. The specification requires it; practice lags badly — an Astrix audit of more than 5,200 servers found only 8.5% using OAuth, against 53% relying on static keys or personal access tokens.
- Credentials MUST NOT be passed through environment variables. The same audit found 79% doing exactly that.
- Each server MUST have its own identity, not one shared across the fleet.
Section 3 — Tool surface
- Command-executing tools MUST use an allowlist of commands, not input filtering. Ad hoc filtering is insufficient when the design permits subprocess execution.
- Tool descriptions MUST be treated as untrusted data and pinned to a known hash, so silent changes are detectable.
- Write tools MUST require human approval when the action is irreversible.
Section 4 — Observability
- Every invocation MUST emit an event carrying identity, tool name, arguments and outcome, delivered to the corporate SIEM.
- Authorization denials MUST be logged with the same priority as successes.
Why the form matters more than the content
None of this is intellectually hard. The hard part was always turning recommendation into proof. A CIS benchmark is not valuable because it contains wisdom — it is valuable because each item becomes an automated check, a number in a report and a concrete conversation with audit.
A recommendation without a matching check is not a control. It is well-formatted opinion.
Until that document exists, write your own. One page with fifteen verifiable items, applied to the servers you inventoried, beats waiting for market consensus.
