{ "title": "Local and Remote MCP Security Threat Matrix", "schemaVersion": "1.0", "researchFreeze": "2026-08-26", "protocolRevision": "MCP 2026-07-28", "sourcePackage": "research/10", "integrityNote": "All 108 listed ordinary archive payloads verify. The package contains two incompatible numeric source namespaces; public records preserve an explicit archive namespace and never resolve IDs across families.", "evidencePolicy": "Only manually curated build_context source groups appear in sourceIds. Raw row tokens are preserved under archive and are not treated as publication citations.", "checkedAt": "2026-08-26", "count": 15, "records": [ { "Threat": "Malicious or compromised package", "Local exposure": "Direct execution under user or container identity", "Remote exposure": "Operator build/deploy pipeline; not normally installed by end user", "Affected layer": "Supply chain", "Principal mitigations": "Publisher verification, pinning, signatures/provenance, review, sandbox, controlled updates", "Sources": "S048 S051 S065 S066", "id": "R10-THREAT001", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 1, "sourceIds": [ "S048", "S051", "S065", "S066" ], "raw": { "Threat": "Malicious or compromised package", "Local exposure": "Direct execution under user or container identity", "Remote exposure": "Operator build/deploy pipeline; not normally installed by end user", "Affected layer": "Supply chain", "Principal mitigations": "Publisher verification, pinning, signatures/provenance, review, sandbox, controlled updates", "Sources": "S048 S051 S065 S066" } } }, { "Threat": "Project/workspace configuration code execution", "Local exposure": "High where repository config can launch commands", "Remote exposure": "Usually URL/config risk rather than local command launch", "Affected layer": "Host/configuration", "Principal mitigations": "Trust prompt, repository allowlist, review diffs, sandbox, no auto-start from untrusted repos", "Sources": "S027 S065 S066", "id": "R10-THREAT002", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 2, "sourceIds": [ "S027", "S065", "S066" ], "raw": { "Threat": "Project/workspace configuration code execution", "Local exposure": "High where repository config can launch commands", "Remote exposure": "Usually URL/config risk rather than local command launch", "Affected layer": "Host/configuration", "Principal mitigations": "Trust prompt, repository allowlist, review diffs, sandbox, no auto-start from untrusted repos", "Sources": "S027 S065 S066" } } }, { "Threat": "Environment-variable leakage", "Local exposure": "Child process may inherit broad host environment", "Remote exposure": "Operator services may expose service secrets to code or logs", "Affected layer": "Secrets/process", "Principal mitigations": "Minimal explicit env, secret broker, keychain, no broad inheritance, redaction", "Sources": "S064 S020", "id": "R10-THREAT003", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 3, "sourceIds": [ "S064", "S020" ], "raw": { "Threat": "Environment-variable leakage", "Local exposure": "Child process may inherit broad host environment", "Remote exposure": "Operator services may expose service secrets to code or logs", "Affected layer": "Secrets/process", "Principal mitigations": "Minimal explicit env, secret broker, keychain, no broad inheritance, redaction", "Sources": "S064 S020" } } }, { "Threat": "Filesystem/OS overreach", "Local exposure": "Server may have user-level file/process authority", "Remote exposure": "Limited unless local bridge/uploads exist; server may overreach in cloud account", "Affected layer": "Authorization", "Principal mitigations": "Sandbox, roots/path allowlists, least-privilege account, dry-run and confirmations", "Sources": "S023 S027", "id": "R10-THREAT004", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 4, "sourceIds": [ "S023", "S027" ], "raw": { "Threat": "Filesystem/OS overreach", "Local exposure": "Server may have user-level file/process authority", "Remote exposure": "Limited unless local bridge/uploads exist; server may overreach in cloud account", "Affected layer": "Authorization", "Principal mitigations": "Sandbox, roots/path allowlists, least-privilege account, dry-run and confirmations", "Sources": "S023 S027" } } }, { "Threat": "DNS rebinding against local HTTP", "Local exposure": "Remote website can target localhost service if host/origin validation is weak", "Remote exposure": "Ordinary host validation/TLS concerns, not uniquely localhost", "Affected layer": "Transport/deployment", "Principal mitigations": "Origin validation, localhost binding, host allowlist, auth, patched SDK", "Sources": "S004 S058 S059 S060 S061 S062", "id": "R10-THREAT005", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 5, "sourceIds": [ "S004", "S058", "S059", "S060", "S061", "S062" ], "raw": { "Threat": "DNS rebinding against local HTTP", "Local exposure": "Remote website can target localhost service if host/origin validation is weak", "Remote exposure": "Ordinary host validation/TLS concerns, not uniquely localhost", "Affected layer": "Transport/deployment", "Principal mitigations": "Origin validation, localhost binding, host allowlist, auth, patched SDK", "Sources": "S004 S058 S059 S060 S061 S062" } } }, { "Threat": "Unbounded message/resource consumption", "Local exposure": "Can exhaust desktop/agent process", "Remote exposure": "Can exhaust shared service or tenant quota", "Affected layer": "SDK/server", "Principal mitigations": "Message limits, timeouts, quotas, backpressure, cancellation", "Sources": "S063 S016", "id": "R10-THREAT006", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 6, "sourceIds": [ "S063", "S016" ], "raw": { "Threat": "Unbounded message/resource consumption", "Local exposure": "Can exhaust desktop/agent process", "Remote exposure": "Can exhaust shared service or tenant quota", "Affected layer": "SDK/server", "Principal mitigations": "Message limits, timeouts, quotas, backpressure, cancellation", "Sources": "S063 S016" } } }, { "Threat": "Token theft or leakage", "Local exposure": "Local API tokens in env/config/keychain", "Remote exposure": "Bearer access/refresh tokens, logs and multi-tenant storage", "Affected layer": "Authorization/secrets", "Principal mitigations": "Secure storage, minimal scopes, TLS, audience binding, rotation, redaction", "Sources": "S005 S052 S057", "id": "R10-THREAT007", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 7, "sourceIds": [ "S005", "S052", "S057" ], "raw": { "Threat": "Token theft or leakage", "Local exposure": "Local API tokens in env/config/keychain", "Remote exposure": "Bearer access/refresh tokens, logs and multi-tenant storage", "Affected layer": "Authorization/secrets", "Principal mitigations": "Secure storage, minimal scopes, TLS, audience binding, rotation, redaction", "Sources": "S005 S052 S057" } } }, { "Threat": "OAuth confused deputy/account mix-up", "Local exposure": "Relevant when local client connects to remote OAuth server", "Remote exposure": "Central remote authorization boundary", "Affected layer": "OAuth", "Principal mitigations": "PKCE, issuer validation, state binding, resource indicators, exact redirects", "Sources": "S052 S053 S054 S055 S056", "id": "R10-THREAT008", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 8, "sourceIds": [ "S052", "S053", "S054", "S055", "S056" ], "raw": { "Threat": "OAuth confused deputy/account mix-up", "Local exposure": "Relevant when local client connects to remote OAuth server", "Remote exposure": "Central remote authorization boundary", "Affected layer": "OAuth", "Principal mitigations": "PKCE, issuer validation, state binding, resource indicators, exact redirects", "Sources": "S052 S053 S054 S055 S056" } } }, { "Threat": "Cross-user or cross-tenant data leakage", "Local exposure": "Lower in single-user process but possible with shared local daemon", "Remote exposure": "Critical in multi-user services and reused transports", "Affected layer": "Server/SDK tenancy", "Principal mitigations": "Per-request identity, tenant partitioning, no shared mutable session/transport state, tests", "Sources": "S068 S042", "id": "R10-THREAT009", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 9, "sourceIds": [ "S068", "S042" ], "raw": { "Threat": "Cross-user or cross-tenant data leakage", "Local exposure": "Lower in single-user process but possible with shared local daemon", "Remote exposure": "Critical in multi-user services and reused transports", "Affected layer": "Server/SDK tenancy", "Principal mitigations": "Per-request identity, tenant partitioning, no shared mutable session/transport state, tests", "Sources": "S068 S042" } } }, { "Threat": "Network interception/endpoint impersonation", "Local exposure": "Low over stdio; local proxy can still be attacked", "Remote exposure": "TLS, DNS and endpoint identity central", "Affected layer": "Network", "Principal mitigations": "HTTPS, certificate validation, approved endpoint catalog, no token forwarding", "Sources": "S004 S005", "id": "R10-THREAT010", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 10, "sourceIds": [ "S004", "S005" ], "raw": { "Threat": "Network interception/endpoint impersonation", "Local exposure": "Low over stdio; local proxy can still be attacked", "Remote exposure": "TLS, DNS and endpoint identity central", "Affected layer": "Network", "Principal mitigations": "HTTPS, certificate validation, approved endpoint catalog, no token forwarding", "Sources": "S004 S005" } } }, { "Threat": "Availability/common-mode outage", "Local exposure": "Usually affects one user/device", "Remote exposure": "Can affect all consumers simultaneously", "Affected layer": "Operations", "Principal mitigations": "Health checks, redundancy, regional design, graceful degradation, local fallback where justified", "Sources": "S039 S041", "id": "R10-THREAT011", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 11, "sourceIds": [ "S039", "S041" ], "raw": { "Threat": "Availability/common-mode outage", "Local exposure": "Usually affects one user/device", "Remote exposure": "Can affect all consumers simultaneously", "Affected layer": "Operations", "Principal mitigations": "Health checks, redundancy, regional design, graceful degradation, local fallback where justified", "Sources": "S039 S041" } } }, { "Threat": "Prompt injection in tool/resource content", "Local exposure": "Yes", "Remote exposure": "Yes", "Affected layer": "Model/data", "Principal mitigations": "Treat content as untrusted, tool isolation, provenance, confirmations, least privilege", "Sources": "S016", "id": "R10-THREAT012", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 12, "sourceIds": [ "S016" ], "raw": { "Threat": "Prompt injection in tool/resource content", "Local exposure": "Yes", "Remote exposure": "Yes", "Affected layer": "Model/data", "Principal mitigations": "Treat content as untrusted, tool isolation, provenance, confirmations, least privilege", "Sources": "S016" } } }, { "Threat": "Excessive upstream permissions", "Local exposure": "Personal token may be overbroad", "Remote exposure": "Shared service/delegated token may be overbroad", "Affected layer": "Underlying system", "Principal mitigations": "Narrow scopes, object-level authorization, separate read/write tools, audits", "Sources": "S005 S037", "id": "R10-THREAT013", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 13, "sourceIds": [ "S005", "S037" ], "raw": { "Threat": "Excessive upstream permissions", "Local exposure": "Personal token may be overbroad", "Remote exposure": "Shared service/delegated token may be overbroad", "Affected layer": "Underlying system", "Principal mitigations": "Narrow scopes, object-level authorization, separate read/write tools, audits", "Sources": "S005 S037" } } }, { "Threat": "Proxy/tunnel compromise", "Local exposure": "Local tunnel package can execute code and hold tokens", "Remote exposure": "Tunnel endpoint becomes part of service boundary", "Affected layer": "Bridge/proxy", "Principal mitigations": "Prefer native transport when supported, patched proxy, scope tokens, monitor tunnel", "Sources": "S026 S067 S075", "id": "R10-THREAT014", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 14, "sourceIds": [ "S026", "S067", "S075" ], "raw": { "Threat": "Proxy/tunnel compromise", "Local exposure": "Local tunnel package can execute code and hold tokens", "Remote exposure": "Tunnel endpoint becomes part of service boundary", "Affected layer": "Bridge/proxy", "Principal mitigations": "Prefer native transport when supported, patched proxy, scope tokens, monitor tunnel", "Sources": "S026 S067 S075" } } }, { "Threat": "Central operator compromise", "Local exposure": "Distributed installs reduce single service compromise but updates can still propagate", "Remote exposure": "One operator breach can affect all tenants", "Affected layer": "Operations/supply chain", "Principal mitigations": "Separation of duties, deployment signing, workload identity, audit, incident response", "Sources": "S037 S042", "id": "R10-THREAT015", "sourceIds": [ "S133", "S134", "S475", "S191", "S006", "S005", "S192", "S004", "S193", "S111", "S112", "S207", "S208", "S210", "S212", "S238", "S233", "S245", "S243", "S147", "S109", "S196", "S485" ], "evidenceStatus": "curated-dataset-level-evidence; not an archive row-level citation mapping", "archive": { "namespace": "research/10/security_threat_matrix.json", "row": 15, "sourceIds": [ "S037", "S042" ], "raw": { "Threat": "Central operator compromise", "Local exposure": "Distributed installs reduce single service compromise but updates can still propagate", "Remote exposure": "One operator breach can affect all tenants", "Affected layer": "Operations/supply chain", "Principal mitigations": "Separation of duties, deployment signing, workload identity, audit, incident response", "Sources": "S037 S042" } } } ] }