{
  "title": "MCP Gateway Security Threat Register",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "MCP 2026-07-28",
  "sourcePackage": "research/11",
  "integrityNote": "All 84 listed archive payloads verify by SHA-256. Public datasets are a narrow, noindex selection; product rankings and unexecuted test results are not published.",
  "checkedAt": "2026-08-26",
  "indexing": "noindex, follow",
  "evidencePolicy": "Archive source IDs are mapped to the site-wide canonical evidence library; analytical rows disclose dataset-level evidence.",
  "count": 25,
  "records": [
    {
      "Threat": "Gateway data-plane compromise",
      "Layer": "Data plane",
      "Attack path": "Modify or observe all calls",
      "Impact": "Credential/data theft and false results",
      "Mitigations": "Minimal privileges, immutable deploy, isolation, signing",
      "Source IDs": "S013; S058",
      "id": "R11-THREAT001",
      "sourceIds": [
        "S134",
        "S534"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 1,
        "packageSourceIds": [
          "S013",
          "S058"
        ],
        "raw": {
          "Threat": "Gateway data-plane compromise",
          "Layer": "Data plane",
          "Attack path": "Modify or observe all calls",
          "Impact": "Credential/data theft and false results",
          "Mitigations": "Minimal privileges, immutable deploy, isolation, signing",
          "Source IDs": "S013; S058"
        }
      }
    },
    {
      "Threat": "Control-plane compromise",
      "Layer": "Control plane",
      "Attack path": "Register malicious server or change policy",
      "Impact": "Fleet-wide compromise",
      "Mitigations": "Separate admins, MFA, approvals, immutable audit",
      "Source IDs": "S022; S030",
      "id": "R11-THREAT002",
      "sourceIds": [
        "S504",
        "S511"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 2,
        "packageSourceIds": [
          "S022",
          "S030"
        ],
        "raw": {
          "Threat": "Control-plane compromise",
          "Layer": "Control plane",
          "Attack path": "Register malicious server or change policy",
          "Impact": "Fleet-wide compromise",
          "Mitigations": "Separate admins, MFA, approvals, immutable audit",
          "Source IDs": "S022; S030"
        }
      }
    },
    {
      "Threat": "Token passthrough",
      "Layer": "Authorization",
      "Attack path": "Forward token to wrong resource",
      "Impact": "Audience confusion and token theft",
      "Mitigations": "Validate audience; exchange/separate credential",
      "Source IDs": "S003; S013",
      "id": "R11-THREAT003",
      "sourceIds": [
        "S133",
        "S134"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 3,
        "packageSourceIds": [
          "S003",
          "S013"
        ],
        "raw": {
          "Threat": "Token passthrough",
          "Layer": "Authorization",
          "Attack path": "Forward token to wrong resource",
          "Impact": "Audience confusion and token theft",
          "Mitigations": "Validate audience; exchange/separate credential",
          "Source IDs": "S003; S013"
        }
      }
    },
    {
      "Threat": "Confused deputy / mix-up",
      "Layer": "Authorization",
      "Attack path": "Wrong issuer, AS or resource",
      "Impact": "Unauthorized access",
      "Mitigations": "Issuer identification, PRM, Resource Indicators",
      "Source IDs": "S051; S052; S053",
      "id": "R11-THREAT004",
      "sourceIds": [
        "S005",
        "S192",
        "S006"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 4,
        "packageSourceIds": [
          "S051",
          "S052",
          "S053"
        ],
        "raw": {
          "Threat": "Confused deputy / mix-up",
          "Layer": "Authorization",
          "Attack path": "Wrong issuer, AS or resource",
          "Impact": "Unauthorized access",
          "Mitigations": "Issuer identification, PRM, Resource Indicators",
          "Source IDs": "S051; S052; S053"
        }
      }
    },
    {
      "Threat": "Tool poisoning",
      "Layer": "Catalog/model",
      "Attack path": "Malicious descriptions or schemas",
      "Impact": "Bad selection or exfiltration",
      "Mitigations": "Publisher trust, schema review, filtering",
      "Source IDs": "S059; S080",
      "id": "R11-THREAT005",
      "sourceIds": [
        "S108"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 5,
        "packageSourceIds": [
          "S059",
          "S080"
        ],
        "raw": {
          "Threat": "Tool poisoning",
          "Layer": "Catalog/model",
          "Attack path": "Malicious descriptions or schemas",
          "Impact": "Bad selection or exfiltration",
          "Mitigations": "Publisher trust, schema review, filtering",
          "Source IDs": "S059; S080"
        }
      }
    },
    {
      "Threat": "Schema rug pull",
      "Layer": "Supply chain",
      "Attack path": "Change meaning after approval",
      "Impact": "Old policy permits new behavior",
      "Mitigations": "Schema hashes, reapproval, version pinning",
      "Source IDs": "S080",
      "id": "R11-THREAT006",
      "sourceIds": [
        "S108"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 6,
        "packageSourceIds": [
          "S080"
        ],
        "raw": {
          "Threat": "Schema rug pull",
          "Layer": "Supply chain",
          "Attack path": "Change meaning after approval",
          "Impact": "Old policy permits new behavior",
          "Mitigations": "Schema hashes, reapproval, version pinning",
          "Source IDs": "S080"
        }
      }
    },
    {
      "Threat": "Header/body mismatch",
      "Layer": "Transport/routing",
      "Attack path": "Safe header, destructive body",
      "Impact": "Policy bypass",
      "Mitigations": "Validate header against body",
      "Source IDs": "S002; S010",
      "id": "R11-THREAT007",
      "sourceIds": [
        "S131",
        "S497"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 7,
        "packageSourceIds": [
          "S002",
          "S010"
        ],
        "raw": {
          "Threat": "Header/body mismatch",
          "Layer": "Transport/routing",
          "Attack path": "Safe header, destructive body",
          "Impact": "Policy bypass",
          "Mitigations": "Validate header against body",
          "Source IDs": "S002; S010"
        }
      }
    },
    {
      "Threat": "Resource URI SSRF/file access",
      "Layer": "Resources",
      "Attack path": "Internal or file URI",
      "Impact": "Internal access or disclosure",
      "Mitigations": "Scheme/origin allowlists, no auto-fetch",
      "Source IDs": "S026; S027",
      "id": "R11-THREAT008",
      "sourceIds": [
        "S507",
        "S508"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 8,
        "packageSourceIds": [
          "S026",
          "S027"
        ],
        "raw": {
          "Threat": "Resource URI SSRF/file access",
          "Layer": "Resources",
          "Attack path": "Internal or file URI",
          "Impact": "Internal access or disclosure",
          "Mitigations": "Scheme/origin allowlists, no auto-fetch",
          "Source IDs": "S026; S027"
        }
      }
    },
    {
      "Threat": "Cross-tenant cache leakage",
      "Layer": "Caching",
      "Attack path": "Share private result",
      "Impact": "Capability/data disclosure",
      "Mitigations": "Honor cacheScope and auth context",
      "Source IDs": "S005; S011",
      "id": "R11-THREAT009",
      "sourceIds": [
        "S128",
        "S498"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 9,
        "packageSourceIds": [
          "S005",
          "S011"
        ],
        "raw": {
          "Threat": "Cross-tenant cache leakage",
          "Layer": "Caching",
          "Attack path": "Share private result",
          "Impact": "Capability/data disclosure",
          "Mitigations": "Honor cacheScope and auth context",
          "Source IDs": "S005; S011"
        }
      }
    },
    {
      "Threat": "Catalog collision/shadowing",
      "Layer": "Aggregation",
      "Attack path": "Duplicate tool or URI",
      "Impact": "Wrong target invoked",
      "Mitigations": "Namespaces, provenance, collision rules",
      "Source IDs": "S024; S031",
      "id": "R11-THREAT010",
      "sourceIds": [
        "S476",
        "S512"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 10,
        "packageSourceIds": [
          "S024",
          "S031"
        ],
        "raw": {
          "Threat": "Catalog collision/shadowing",
          "Layer": "Aggregation",
          "Attack path": "Duplicate tool or URI",
          "Impact": "Wrong target invoked",
          "Mitigations": "Namespaces, provenance, collision rules",
          "Source IDs": "S024; S031"
        }
      }
    },
    {
      "Threat": "Argument tampering",
      "Layer": "Proxy policy",
      "Attack path": "Gateway rewrites parameters",
      "Impact": "Unexpected operation",
      "Mitigations": "Minimize transforms, log diffs, downstream validate",
      "Source IDs": "S002",
      "id": "R11-THREAT011",
      "sourceIds": [
        "S131"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 11,
        "packageSourceIds": [
          "S002"
        ],
        "raw": {
          "Threat": "Argument tampering",
          "Layer": "Proxy policy",
          "Attack path": "Gateway rewrites parameters",
          "Impact": "Unexpected operation",
          "Mitigations": "Minimize transforms, log diffs, downstream validate",
          "Source IDs": "S002"
        }
      }
    },
    {
      "Threat": "Over-logging",
      "Layer": "Observability",
      "Attack path": "Store tokens and payloads",
      "Impact": "Credential/data exposure",
      "Mitigations": "Redaction, encryption, retention limits",
      "Source IDs": "S056; S058",
      "id": "R11-THREAT012",
      "sourceIds": [
        "S532",
        "S534"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 12,
        "packageSourceIds": [
          "S056",
          "S058"
        ],
        "raw": {
          "Threat": "Over-logging",
          "Layer": "Observability",
          "Attack path": "Store tokens and payloads",
          "Impact": "Credential/data exposure",
          "Mitigations": "Redaction, encryption, retention limits",
          "Source IDs": "S056; S058"
        }
      }
    },
    {
      "Threat": "Policy fail-open",
      "Layer": "Policy",
      "Attack path": "Timeout or malformed decision",
      "Impact": "Unauthorized call",
      "Mitigations": "Fail closed for high-risk operations",
      "Source IDs": "S061",
      "id": "R11-THREAT013",
      "sourceIds": [
        "S535"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 13,
        "packageSourceIds": [
          "S061"
        ],
        "raw": {
          "Threat": "Policy fail-open",
          "Layer": "Policy",
          "Attack path": "Timeout or malformed decision",
          "Impact": "Unauthorized call",
          "Mitigations": "Fail closed for high-risk operations",
          "Source IDs": "S061"
        }
      }
    },
    {
      "Threat": "Gateway denial of service",
      "Layer": "Availability",
      "Attack path": "Catalog/schema/stream exhaustion",
      "Impact": "Central outage",
      "Mitigations": "Limits, quotas, circuit breakers, scaling",
      "Source IDs": "S002; S005",
      "id": "R11-THREAT014",
      "sourceIds": [
        "S131",
        "S128"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 14,
        "packageSourceIds": [
          "S002",
          "S005"
        ],
        "raw": {
          "Threat": "Gateway denial of service",
          "Layer": "Availability",
          "Attack path": "Catalog/schema/stream exhaustion",
          "Impact": "Central outage",
          "Mitigations": "Limits, quotas, circuit breakers, scaling",
          "Source IDs": "S002; S005"
        }
      }
    },
    {
      "Threat": "Management SQL injection",
      "Layer": "Implementation",
      "Attack path": "Craft retention table name",
      "Impact": "Read/alter database and API keys",
      "Mitigations": "Upgrade 1.0.13+, parameterized SQL, RBAC",
      "Source IDs": "S030",
      "id": "R11-THREAT015",
      "sourceIds": [
        "S511"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 15,
        "packageSourceIds": [
          "S030"
        ],
        "raw": {
          "Threat": "Management SQL injection",
          "Layer": "Implementation",
          "Attack path": "Craft retention table name",
          "Impact": "Read/alter database and API keys",
          "Mitigations": "Upgrade 1.0.13+, parameterized SQL, RBAC",
          "Source IDs": "S030"
        }
      }
    },
    {
      "Threat": "App-only tool exposure",
      "Layer": "MCP Apps",
      "Attack path": "Publish private app tool to model",
      "Impact": "Capability misuse",
      "Mitigations": "Preserve visibility and same-server restriction",
      "Source IDs": "S063",
      "id": "R11-THREAT016",
      "sourceIds": [
        "S136"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 16,
        "packageSourceIds": [
          "S063"
        ],
        "raw": {
          "Threat": "App-only tool exposure",
          "Layer": "MCP Apps",
          "Attack path": "Publish private app tool to model",
          "Impact": "Capability misuse",
          "Mitigations": "Preserve visibility and same-server restriction",
          "Source IDs": "S063"
        }
      }
    },
    {
      "Threat": "Task ownership confusion",
      "Layer": "Tasks",
      "Attack path": "ID collision or guessing",
      "Impact": "Status/result leak or cancellation",
      "Mitigations": "Namespace and authorize every operation",
      "Source IDs": "S064",
      "id": "R11-THREAT017",
      "sourceIds": [
        "S137"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 17,
        "packageSourceIds": [
          "S064"
        ],
        "raw": {
          "Threat": "Task ownership confusion",
          "Layer": "Tasks",
          "Attack path": "ID collision or guessing",
          "Impact": "Status/result leak or cancellation",
          "Mitigations": "Namespace and authorize every operation",
          "Source IDs": "S064"
        }
      }
    },
    {
      "Threat": "Delegation-chain loss",
      "Layer": "MCP+A2A",
      "Attack path": "Reduce chain to one service token",
      "Impact": "Excess authority, no accountability",
      "Mitigations": "Preserve user, agent, purpose, target",
      "Source IDs": "S062",
      "id": "R11-THREAT018",
      "sourceIds": [
        "S339"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 18,
        "packageSourceIds": [
          "S062"
        ],
        "raw": {
          "Threat": "Delegation-chain loss",
          "Layer": "MCP+A2A",
          "Attack path": "Reduce chain to one service token",
          "Impact": "Excess authority, no accountability",
          "Mitigations": "Preserve user, agent, purpose, target",
          "Source IDs": "S062"
        }
      }
    },
    {
      "Threat": "Malicious downstream server",
      "Layer": "Server trust",
      "Attack path": "Compromised/fake server",
      "Impact": "Bad tools and exfiltration",
      "Mitigations": "Publisher verification, isolation, revocation",
      "Source IDs": "S020; S059",
      "id": "R11-THREAT019",
      "sourceIds": [
        "S067",
        "S108"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 19,
        "packageSourceIds": [
          "S020",
          "S059"
        ],
        "raw": {
          "Threat": "Malicious downstream server",
          "Layer": "Server trust",
          "Attack path": "Compromised/fake server",
          "Impact": "Bad tools and exfiltration",
          "Mitigations": "Publisher verification, isolation, revocation",
          "Source IDs": "S020; S059"
        }
      }
    },
    {
      "Threat": "Gateway sole authorization layer",
      "Layer": "Architecture",
      "Attack path": "Downstream trusts powerful gateway credential",
      "Impact": "Bug bypasses native controls",
      "Mitigations": "Keep native IAM and object authorization",
      "Source IDs": "S057; S058",
      "id": "R11-THREAT020",
      "sourceIds": [
        "S533",
        "S534"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 20,
        "packageSourceIds": [
          "S057",
          "S058"
        ],
        "raw": {
          "Threat": "Gateway sole authorization layer",
          "Layer": "Architecture",
          "Attack path": "Downstream trusts powerful gateway credential",
          "Impact": "Bug bypasses native controls",
          "Mitigations": "Keep native IAM and object authorization",
          "Source IDs": "S057; S058"
        }
      }
    },
    {
      "Threat": "OAuth metadata SSRF",
      "Layer": "Authorization discovery",
      "Attack path": "Fetch attacker metadata URL",
      "Impact": "Internal network access",
      "Mitigations": "Metadata-domain allowlists and URL validation",
      "Source IDs": "S037",
      "id": "R11-THREAT021",
      "sourceIds": [
        "S518"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 21,
        "packageSourceIds": [
          "S037"
        ],
        "raw": {
          "Threat": "OAuth metadata SSRF",
          "Layer": "Authorization discovery",
          "Attack path": "Fetch attacker metadata URL",
          "Impact": "Internal network access",
          "Mitigations": "Metadata-domain allowlists and URL validation",
          "Source IDs": "S037"
        }
      }
    },
    {
      "Threat": "Stale catalog after revocation",
      "Layer": "Control/data plane",
      "Attack path": "Cache remains usable",
      "Impact": "Revoked capability still invoked",
      "Mitigations": "Push invalidation, short TTL, runtime deny",
      "Source IDs": "S005",
      "id": "R11-THREAT022",
      "sourceIds": [
        "S128"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 22,
        "packageSourceIds": [
          "S005"
        ],
        "raw": {
          "Threat": "Stale catalog after revocation",
          "Layer": "Control/data plane",
          "Attack path": "Cache remains usable",
          "Impact": "Revoked capability still invoked",
          "Mitigations": "Push invalidation, short TTL, runtime deny",
          "Source IDs": "S005"
        }
      }
    },
    {
      "Threat": "Prompt/result injection",
      "Layer": "Content",
      "Attack path": "Untrusted content influences model",
      "Impact": "Cross-tool abuse",
      "Mitigations": "Host isolation, provenance, confirmation",
      "Source IDs": "S058; S059",
      "id": "R11-THREAT023",
      "sourceIds": [
        "S534",
        "S108"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 23,
        "packageSourceIds": [
          "S058",
          "S059"
        ],
        "raw": {
          "Threat": "Prompt/result injection",
          "Layer": "Content",
          "Attack path": "Untrusted content influences model",
          "Impact": "Cross-tool abuse",
          "Mitigations": "Host isolation, provenance, confirmation",
          "Source IDs": "S058; S059"
        }
      }
    },
    {
      "Threat": "Credential fallback escalation",
      "Layer": "Secrets",
      "Attack path": "Refresh failure uses broad service account",
      "Impact": "Privilege escalation",
      "Mitigations": "No silent fallback; explicit credential policy",
      "Source IDs": "S036; S037",
      "id": "R11-THREAT024",
      "sourceIds": [
        "S517",
        "S518"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 24,
        "packageSourceIds": [
          "S036",
          "S037"
        ],
        "raw": {
          "Threat": "Credential fallback escalation",
          "Layer": "Secrets",
          "Attack path": "Refresh failure uses broad service account",
          "Impact": "Privilege escalation",
          "Mitigations": "No silent fallback; explicit credential policy",
          "Source IDs": "S036; S037"
        }
      }
    },
    {
      "Threat": "Federation trust confusion",
      "Layer": "Federated gateway",
      "Attack path": "Trust remote domain metadata blindly",
      "Impact": "Cross-domain compromise",
      "Mitigations": "Domain trust contracts, signed provenance, local policy",
      "Source IDs": "S057",
      "id": "R11-THREAT025",
      "sourceIds": [
        "S533"
      ],
      "evidenceStatus": "archive row citations mapped through the research/11 evidence manifest",
      "archive": {
        "namespace": "research/11/MCP_GATEWAY_SECURITY_THREATS.json",
        "row": 25,
        "packageSourceIds": [
          "S057"
        ],
        "raw": {
          "Threat": "Federation trust confusion",
          "Layer": "Federated gateway",
          "Attack path": "Trust remote domain metadata blindly",
          "Impact": "Cross-domain compromise",
          "Mitigations": "Domain trust contracts, signed provenance, local policy",
          "Source IDs": "S057"
        }
      }
    }
  ]
}