{ "title": "Local and Remote MCP Security Risk Matrix", "schemaVersion": "1.0", "researchFreeze": "2026-08-26", "protocolRevision": "MCP 2026-07-28", "sourcePackage": "research/10", "integrityNote": "All 108 listed ordinary archive payloads verify. The package contains two incompatible numeric source namespaces; public records preserve an explicit archive namespace and never resolve IDs across families.", "evidencePolicy": "Only manually curated build_context source groups appear in sourceIds. Raw row tokens are preserved under archive and are not treated as publication citations.", "checkedAt": "2026-08-26", "count": 15, "records": [ { "Threat": "Malicious or compromised server code", "Local MCP exposure": "Runs under local OS identity and can affect the user machine", "Remote MCP exposure": "Runs in operator environment; users trust service behavior", "Primary layer": "Supply chain / implementation", "Primary mitigations": "Publisher verification, code review, sandboxing, pinning, signed artifacts, least privilege", "Source IDs": "S013 S016 S039 S064 S065 S066", "id": "R10-RISK001", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 1, "sourceIds": [ "S013", "S016", "S039", "S064", "S065", "S066" ], "raw": { "Threat": "Malicious or compromised server code", "Local MCP exposure": "Runs under local OS identity and can affect the user machine", "Remote MCP exposure": "Runs in operator environment; users trust service behavior", "Primary layer": "Supply chain / implementation", "Primary mitigations": "Publisher verification, code review, sandboxing, pinning, signed artifacts, least privilege", "Source IDs": "S013 S016 S039 S064 S065 S066" } } }, { "Threat": "Environment-variable leakage", "Local MCP exposure": "Child process may inherit unrelated secrets", "Remote MCP exposure": "Server process may receive broad platform secrets", "Primary layer": "Secrets", "Primary mitigations": "Explicit env allowlist; dedicated credential broker; avoid whole-environment inheritance", "Source IDs": "S004 S013 S067", "id": "R10-RISK002", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 2, "sourceIds": [ "S004", "S013", "S067" ], "raw": { "Threat": "Environment-variable leakage", "Local MCP exposure": "Child process may inherit unrelated secrets", "Remote MCP exposure": "Server process may receive broad platform secrets", "Primary layer": "Secrets", "Primary mitigations": "Explicit env allowlist; dedicated credential broker; avoid whole-environment inheritance", "Source IDs": "S004 S013 S067" } } }, { "Threat": "Filesystem overreach", "Local MCP exposure": "Direct and often high-impact", "Remote MCP exposure": "Normally absent unless mounted or bridged", "Primary layer": "Authorization", "Primary mitigations": "Root/path allowlists, canonicalization, OS sandbox, read-only mounts", "Source IDs": "S011 S013", "id": "R10-RISK003", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 3, "sourceIds": [ "S011", "S013" ], "raw": { "Threat": "Filesystem overreach", "Local MCP exposure": "Direct and often high-impact", "Remote MCP exposure": "Normally absent unless mounted or bridged", "Primary layer": "Authorization", "Primary mitigations": "Root/path allowlists, canonicalization, OS sandbox, read-only mounts", "Source IDs": "S011 S013" } } }, { "Threat": "DNS rebinding", "Local MCP exposure": "Relevant to local HTTP servers, not stdio pipes", "Remote MCP exposure": "Relevant when endpoints accept browser-originated requests", "Primary layer": "Transport", "Primary mitigations": "Validate Origin, bind local HTTP to loopback, authenticate every connection", "Source IDs": "S003 S013", "id": "R10-RISK004", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 4, "sourceIds": [ "S003", "S013" ], "raw": { "Threat": "DNS rebinding", "Local MCP exposure": "Relevant to local HTTP servers, not stdio pipes", "Remote MCP exposure": "Relevant when endpoints accept browser-originated requests", "Primary layer": "Transport", "Primary mitigations": "Validate Origin, bind local HTTP to loopback, authenticate every connection", "Source IDs": "S003 S013" } } }, { "Threat": "Token theft", "Local MCP exposure": "Local tokens in env/config/keychain", "Remote MCP exposure": "Bearer tokens, refresh tokens and delegated credentials", "Primary layer": "Authorization", "Primary mitigations": "Short-lived audience-bound tokens, secure storage, no query-string tokens", "Source IDs": "S004 S005 S068 S069", "id": "R10-RISK005", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 5, "sourceIds": [ "S004", "S005", "S068", "S069" ], "raw": { "Threat": "Token theft", "Local MCP exposure": "Local tokens in env/config/keychain", "Remote MCP exposure": "Bearer tokens, refresh tokens and delegated credentials", "Primary layer": "Authorization", "Primary mitigations": "Short-lived audience-bound tokens, secure storage, no query-string tokens", "Source IDs": "S004 S005 S068 S069" } } }, { "Threat": "Token passthrough/confused deputy", "Local MCP exposure": "Local wrapper can forward wrong upstream token", "Remote MCP exposure": "Gateway/server may accept or relay tokens not issued for it", "Primary layer": "Authorization", "Primary mitigations": "Resource Indicators, audience validation, explicit token exchange", "Source IDs": "S004 S005 S053", "id": "R10-RISK006", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 6, "sourceIds": [ "S004", "S005", "S053" ], "raw": { "Threat": "Token passthrough/confused deputy", "Local MCP exposure": "Local wrapper can forward wrong upstream token", "Remote MCP exposure": "Gateway/server may accept or relay tokens not issued for it", "Primary layer": "Authorization", "Primary mitigations": "Resource Indicators, audience validation, explicit token exchange", "Source IDs": "S004 S005 S053" } } }, { "Threat": "Multi-tenant data leakage", "Local MCP exposure": "Usually one local identity, but shared machine remains possible", "Remote MCP exposure": "Critical risk across users/organizations", "Primary layer": "Application / deployment", "Primary mitigations": "Tenant-bound auth context, row/object checks, cacheScope, isolated state handles", "Source IDs": "S004 S007 S013 S062", "id": "R10-RISK007", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 7, "sourceIds": [ "S004", "S007", "S013", "S062" ], "raw": { "Threat": "Multi-tenant data leakage", "Local MCP exposure": "Usually one local identity, but shared machine remains possible", "Remote MCP exposure": "Critical risk across users/organizations", "Primary layer": "Application / deployment", "Primary mitigations": "Tenant-bound auth context, row/object checks, cacheScope, isolated state handles", "Source IDs": "S004 S007 S013 S062" } } }, { "Threat": "Prompt injection/tool poisoning", "Local MCP exposure": "Untrusted local files or tool metadata can influence model", "Remote MCP exposure": "Remote data/tool metadata can do the same at scale", "Primary layer": "Model / host", "Primary mitigations": "Treat content and metadata as untrusted; host filtering, provenance and confirmations", "Source IDs": "S013 S063", "id": "R10-RISK008", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 8, "sourceIds": [ "S013", "S063" ], "raw": { "Threat": "Prompt injection/tool poisoning", "Local MCP exposure": "Untrusted local files or tool metadata can influence model", "Remote MCP exposure": "Remote data/tool metadata can do the same at scale", "Primary layer": "Model / host", "Primary mitigations": "Treat content and metadata as untrusted; host filtering, provenance and confirmations", "Source IDs": "S013 S063" } } }, { "Threat": "Network interception", "Local MCP exposure": "Not present on stdio channel", "Remote MCP exposure": "Possible over network", "Primary layer": "Transport", "Primary mitigations": "HTTPS, certificate validation, private networking where appropriate", "Source IDs": "S003 S004", "id": "R10-RISK009", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 9, "sourceIds": [ "S003", "S004" ], "raw": { "Threat": "Network interception", "Local MCP exposure": "Not present on stdio channel", "Remote MCP exposure": "Possible over network", "Primary layer": "Transport", "Primary mitigations": "HTTPS, certificate validation, private networking where appropriate", "Source IDs": "S003 S004" } } }, { "Threat": "Availability attack", "Local MCP exposure": "Kills or exhausts one local process/device", "Remote MCP exposure": "Can affect many users and shared dependencies", "Primary layer": "Operations", "Primary mitigations": "Local process limits; remote rate limits, quotas, autoscaling and circuit breakers", "Source IDs": "S051 S056 S062", "id": "R10-RISK010", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 10, "sourceIds": [ "S051", "S056", "S062" ], "raw": { "Threat": "Availability attack", "Local MCP exposure": "Kills or exhausts one local process/device", "Remote MCP exposure": "Can affect many users and shared dependencies", "Primary layer": "Operations", "Primary mitigations": "Local process limits; remote rate limits, quotas, autoscaling and circuit breakers", "Source IDs": "S051 S056 S062" } } }, { "Threat": "Unsafe project configuration", "Local MCP exposure": "Repository can request local command execution", "Remote MCP exposure": "Remote URL configuration can redirect traffic to malicious service", "Primary layer": "Host/config", "Primary mitigations": "Trust prompts, policy allowlists, signed/managed config and source review", "Source IDs": "S039 S040 S042 S045 S065 S066", "id": "R10-RISK011", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 11, "sourceIds": [ "S039", "S040", "S042", "S045", "S065", "S066" ], "raw": { "Threat": "Unsafe project configuration", "Local MCP exposure": "Repository can request local command execution", "Remote MCP exposure": "Remote URL configuration can redirect traffic to malicious service", "Primary layer": "Host/config", "Primary mitigations": "Trust prompts, policy allowlists, signed/managed config and source review", "Source IDs": "S039 S040 S042 S045 S065 S066" } } }, { "Threat": "Secret in command line", "Local MCP exposure": "May appear in process lists or logs", "Remote MCP exposure": "Deployment command may leak build/deploy secrets", "Primary layer": "Secrets", "Primary mitigations": "Environment/keychain/secret-manager references, redact logs", "Source IDs": "S039 S042", "id": "R10-RISK012", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 12, "sourceIds": [ "S039", "S042" ], "raw": { "Threat": "Secret in command line", "Local MCP exposure": "May appear in process lists or logs", "Remote MCP exposure": "Deployment command may leak build/deploy secrets", "Primary layer": "Secrets", "Primary mitigations": "Environment/keychain/secret-manager references, redact logs", "Source IDs": "S039 S042" } } }, { "Threat": "Overbroad tool authority", "Local MCP exposure": "Local process inherits OS/user power", "Remote MCP exposure": "Remote service account or OAuth scopes may be excessive", "Primary layer": "Authorization", "Primary mitigations": "Tool-level scopes, semantic validation, read-only defaults, approval for destructive actions", "Source IDs": "S004 S013 S062", "id": "R10-RISK013", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 13, "sourceIds": [ "S004", "S013", "S062" ], "raw": { "Threat": "Overbroad tool authority", "Local MCP exposure": "Local process inherits OS/user power", "Remote MCP exposure": "Remote service account or OAuth scopes may be excessive", "Primary layer": "Authorization", "Primary mitigations": "Tool-level scopes, semantic validation, read-only defaults, approval for destructive actions", "Source IDs": "S004 S013 S062" } } }, { "Threat": "Gateway policy bypass", "Local MCP exposure": "Usually not applicable unless local gateway used", "Remote MCP exposure": "Clients may bypass central gateway and call server directly", "Primary layer": "Enterprise architecture", "Primary mitigations": "Network policy, server-side required gateway identity, private endpoints", "Source IDs": "S052 S054 S055 S062", "id": "R10-RISK014", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 14, "sourceIds": [ "S052", "S054", "S055", "S062" ], "raw": { "Threat": "Gateway policy bypass", "Local MCP exposure": "Usually not applicable unless local gateway used", "Remote MCP exposure": "Clients may bypass central gateway and call server directly", "Primary layer": "Enterprise architecture", "Primary mitigations": "Network policy, server-side required gateway identity, private endpoints", "Source IDs": "S052 S054 S055 S062" } } }, { "Threat": "Central compromise blast radius", "Local MCP exposure": "Limited to installed users but auto-update can spread", "Remote MCP exposure": "One remote compromise can affect all tenants/users", "Primary layer": "Operations / supply chain", "Primary mitigations": "Staged rollout, canary, rapid rollback, tenant isolation, independent audit", "Source IDs": "S051 S056 S058", "id": "R10-RISK015", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_risk_matrix.json", "row": 15, "sourceIds": [ "S051", "S056", "S058" ], "raw": { "Threat": "Central compromise blast radius", "Local MCP exposure": "Limited to installed users but auto-update can spread", "Remote MCP exposure": "One remote compromise can affect all tenants/users", "Primary layer": "Operations / supply chain", "Primary mitigations": "Staged rollout, canary, rapid rollback, tenant isolation, independent audit", "Source IDs": "S051 S056 S058" } } } ] }