{
  "title": "MCP Security — Normalized Claim Register",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-25",
  "protocolRevision": "2026-07-28",
  "idNote": "claimId is globally namespaced; packageClaimId and packageSourceIds preserve the research/4 identifiers.",
  "count": 98,
  "records": [
    {
      "claimId": "R4-CLM001",
      "packageClaimId": "CLM001",
      "claim": "MCP security is a system property spanning protocol, SDK, host, server, distribution, deployment, authorization, model/data and underlying-system layers.",
      "dateRange": "2024–present",
      "specVersion": "All",
      "packageSourceIds": [
        "SEC014",
        "SEC016",
        "SEC025",
        "SEC039"
      ],
      "sourceIds": [
        "S055",
        "S134",
        "S188",
        "S198"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Cross-layer",
      "durability": "DURABLE",
      "notes": "Analytical synthesis; no single layer can guarantee system security."
    },
    {
      "claimId": "R4-CLM002",
      "packageClaimId": "CLM002",
      "claim": "The launch-era MCP specification did not include the later OAuth authorization framework.",
      "dateRange": "2024-11-05",
      "specVersion": "2024-11-05",
      "packageSourceIds": [
        "SEC002",
        "SEC008"
      ],
      "sourceIds": [
        "S024",
        "S037"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Protocol",
      "durability": "DURABLE",
      "notes": "Do not project 2025 authorization backward."
    },
    {
      "claimId": "R4-CLM003",
      "packageClaimId": "CLM003",
      "claim": "The 2025-03-26 revision introduced an OAuth-oriented authorization framework and Streamable HTTP.",
      "dateRange": "2025-03-26",
      "specVersion": "2025-03-26",
      "packageSourceIds": [
        "SEC007",
        "SEC008"
      ],
      "sourceIds": [
        "S036",
        "S037"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Protocol",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM004",
      "packageClaimId": "CLM004",
      "claim": "The 2025-06-18 revision explicitly treated the MCP server as an OAuth resource server and required Resource Indicators and protected-resource metadata.",
      "dateRange": "2025-06-18",
      "specVersion": "2025-06-18",
      "packageSourceIds": [
        "SEC010",
        "SEC011",
        "SEC029",
        "SEC030"
      ],
      "sourceIds": [
        "S043",
        "S044",
        "S006",
        "S005"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Protocol/authorization",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM005",
      "packageClaimId": "CLM005",
      "claim": "The 2026-07-28 revision removed the initialization handshake and protocol-level sessions.",
      "dateRange": "2026-07-28–present",
      "specVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC014",
        "SEC023"
      ],
      "sourceIds": [
        "S055",
        "S058"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Protocol",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM006",
      "packageClaimId": "CLM006",
      "claim": "Stateless MCP does not prohibit application state; explicit handles, Tasks, databases and authorization records can retain state.",
      "dateRange": "2026-07-28–present",
      "specVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC014",
        "SEC017",
        "SEC021"
      ],
      "sourceIds": [
        "S055",
        "S123",
        "S137"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Protocol/application",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM007",
      "packageClaimId": "CLM007",
      "claim": "Authorization is optional in current MCP; HTTP implementations that support it should follow the MCP authorization specification, while stdio implementations should not use that flow.",
      "dateRange": "2026-07-28–present",
      "specVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC015"
      ],
      "sourceIds": [
        "S133"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Protocol/authorization",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": ""
    },
    {
      "claimId": "R4-CLM008",
      "packageClaimId": "CLM008",
      "claim": "A protected MCP server acts as an OAuth resource server, the MCP client acts as an OAuth client, and the authorization server issues access tokens.",
      "dateRange": "2025-06-18–present",
      "specVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC011",
        "SEC015"
      ],
      "sourceIds": [
        "S044",
        "S133"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Authorization",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM009",
      "packageClaimId": "CLM009",
      "claim": "Current MCP requires Resource Indicators on authorization and token requests and requires the server to validate token audience.",
      "dateRange": "2026-07-28–present",
      "specVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC015",
        "SEC030"
      ],
      "sourceIds": [
        "S133",
        "S005"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Authorization",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": ""
    },
    {
      "claimId": "R4-CLM010",
      "packageClaimId": "CLM010",
      "claim": "Dynamic Client Registration is deprecated in current MCP in favor of Client ID Metadata Documents, while retained for compatibility.",
      "dateRange": "2026-07-28–present",
      "specVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC014",
        "SEC015",
        "SEC034"
      ],
      "sourceIds": [
        "S055",
        "S133",
        "S194"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Authorization",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": ""
    },
    {
      "claimId": "R4-CLM011",
      "packageClaimId": "CLM011",
      "claim": "OAuth does not make a server secure by itself; implementation errors can create confused-deputy, callback, metadata-fetch and token-binding flaws.",
      "dateRange": "2025–present",
      "specVersion": "All remote eras",
      "packageSourceIds": [
        "SEC016",
        "SEC037",
        "SEC071",
        "SEC081"
      ],
      "sourceIds": [
        "S134",
        "S196",
        "S225",
        "S235"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Authorization/implementation",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM012",
      "packageClaimId": "CLM012",
      "claim": "Token passthrough should be prohibited because it breaks audience separation and obscures accountability.",
      "dateRange": "2025–present",
      "specVersion": "Current guidance",
      "packageSourceIds": [
        "SEC016",
        "SEC015"
      ],
      "sourceIds": [
        "S134",
        "S133"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Authorization/server",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": ""
    },
    {
      "claimId": "R4-CLM013",
      "packageClaimId": "CLM013",
      "claim": "Direct stdio intentionally launches a configured local process; this is not automatically a vulnerability.",
      "dateRange": "2024–present",
      "specVersion": "All",
      "packageSourceIds": [
        "SEC003",
        "SEC015",
        "SEC016"
      ],
      "sourceIds": [
        "S027",
        "S133",
        "S134"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Transport/host",
      "durability": "DURABLE",
      "notes": "The risk depends on who controls configuration and process authority."
    },
    {
      "claimId": "R4-CLM014",
      "packageClaimId": "CLM014",
      "claim": "Local HTTP servers can be vulnerable to DNS rebinding even when bound to localhost if authentication and Host validation are absent.",
      "dateRange": "2025–present",
      "specVersion": "HTTP transports",
      "packageSourceIds": [
        "SEC050",
        "SEC051",
        "SEC052",
        "SEC053",
        "SEC054",
        "SEC055"
      ],
      "sourceIds": [
        "S111",
        "S112",
        "S207",
        "S208",
        "S209",
        "S210"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/transport",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM015",
      "packageClaimId": "CLM015",
      "claim": "The TypeScript SDK DNS-rebinding advisory explicitly did not affect stdio transport.",
      "dateRange": "2025-12-02",
      "specVersion": "SDK <1.24.0",
      "packageSourceIds": [
        "SEC050"
      ],
      "sourceIds": [
        "S111"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/transport",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM016",
      "packageClaimId": "CLM016",
      "claim": "Local server packages can read inherited environment variables unless the host restricts the environment.",
      "dateRange": "2024–present",
      "specVersion": "Local",
      "packageSourceIds": [
        "SEC084",
        "SEC016"
      ],
      "sourceIds": [
        "S238",
        "S134"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Host/local process",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM017",
      "packageClaimId": "CLM017",
      "claim": "Project-level MCP configuration is a code-execution boundary when it can cause automatic process launch.",
      "dateRange": "2025–present",
      "specVersion": "Host-specific",
      "packageSourceIds": [
        "SEC079",
        "SEC091",
        "SEC092"
      ],
      "sourceIds": [
        "S233",
        "S245",
        "S246"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/configuration",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM018",
      "packageClaimId": "CLM018",
      "claim": "Tool annotations are descriptive hints and must not be treated as trustworthy security guarantees unless the server is trusted.",
      "dateRange": "2025-03-26–present",
      "specVersion": "All after 2025-03-26",
      "packageSourceIds": [
        "SEC009",
        "SEC017"
      ],
      "sourceIds": [
        "S158",
        "S123"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Protocol/host",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM019",
      "packageClaimId": "CLM019",
      "claim": "Tool poisoning embeds adversarial instructions in tool metadata that the model sees, potentially while the user sees only a simplified representation.",
      "dateRange": "2025-04-01–present",
      "specVersion": "Host/model",
      "packageSourceIds": [
        "SEC035",
        "SEC039"
      ],
      "sourceIds": [
        "S108",
        "S198"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Model/host",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM020",
      "packageClaimId": "CLM020",
      "claim": "Tool shadowing allows a malicious server’s metadata to influence how the model uses a different, trusted server.",
      "dateRange": "2025-04-01–present",
      "specVersion": "Multi-server hosts",
      "packageSourceIds": [
        "SEC035",
        "SEC041"
      ],
      "sourceIds": [
        "S108",
        "S200"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/model",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM021",
      "packageClaimId": "CLM021",
      "claim": "A tool rug pull changes definitions after initial approval, so approval does not establish immutability.",
      "dateRange": "2025-04-01–present",
      "specVersion": "Dynamic/updateable servers",
      "packageSourceIds": [
        "SEC035",
        "SEC041"
      ],
      "sourceIds": [
        "S108",
        "S200"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Supply chain/host",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM022",
      "packageClaimId": "CLM022",
      "claim": "MCP can transport prompt-injection payloads in resources, tool results, schemas and external data; it does not solve prompt injection.",
      "dateRange": "2024–present",
      "specVersion": "All",
      "packageSourceIds": [
        "SEC004",
        "SEC005",
        "SEC039",
        "SEC044"
      ],
      "sourceIds": [
        "S028",
        "S029",
        "S198",
        "S203"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Model/data",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM023",
      "packageClaimId": "CLM023",
      "claim": "Command injection and SQL injection in MCP servers are server implementation vulnerabilities, not unique properties of MCP wire semantics.",
      "dateRange": "2025–present",
      "specVersion": "All",
      "packageSourceIds": [
        "SEC038",
        "SEC077",
        "SEC078"
      ],
      "sourceIds": [
        "S197",
        "S231",
        "S232"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server implementation",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM024",
      "packageClaimId": "CLM024",
      "claim": "Cross-client response leakage can result when mutable server or transport instances are reused across clients.",
      "dateRange": "2026-02",
      "specVersion": "Affected TS SDK",
      "packageSourceIds": [
        "SEC060"
      ],
      "sourceIds": [
        "S147"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/multi-tenancy",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM025",
      "packageClaimId": "CLM025",
      "claim": "Cacheable MCP results require correct public/private scope and authorization-aware cache keys to avoid cross-user leakage.",
      "dateRange": "2026-07-28–present",
      "specVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC014",
        "SEC016"
      ],
      "sourceIds": [
        "S055",
        "S134"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "HTTP/cache",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": ""
    },
    {
      "claimId": "R4-CLM026",
      "packageClaimId": "CLM026",
      "claim": "Explicit state handles should be high-entropy, bound to user or tenant, scoped, expiring and reauthorized on dereference.",
      "dateRange": "2026-07-28–present",
      "specVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC014",
        "SEC016",
        "SEC017"
      ],
      "sourceIds": [
        "S055",
        "S134",
        "S123"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Application state",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": ""
    },
    {
      "claimId": "R4-CLM027",
      "packageClaimId": "CLM027",
      "claim": "MCP Apps add a server-provided UI surface that must be sandboxed and mediated by the host.",
      "dateRange": "2026–present",
      "specVersion": "Apps extension",
      "packageSourceIds": [
        "SEC020"
      ],
      "sourceIds": [
        "S136"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Extension/UI",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": ""
    },
    {
      "claimId": "R4-CLM028",
      "packageClaimId": "CLM028",
      "claim": "Long-running Tasks require continuing authorization and result-access controls because privileges can change while work is in progress.",
      "dateRange": "2025-11-25–present",
      "specVersion": "Tasks",
      "packageSourceIds": [
        "SEC012",
        "SEC021",
        "SEC016"
      ],
      "sourceIds": [
        "S049",
        "S137",
        "S134"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Tasks/application",
      "durability": "PERIODICALLY REVIEW",
      "notes": "Some controls are application responsibility rather than core extension semantics."
    },
    {
      "claimId": "R4-CLM029",
      "packageClaimId": "CLM029",
      "claim": "An official registry listing or namespace verification does not prove that server code is secure.",
      "dateRange": "2025-09–present",
      "specVersion": "Registry",
      "packageSourceIds": [
        "SEC094",
        "SEC095",
        "SEC062",
        "SEC066"
      ],
      "sourceIds": [
        "S066",
        "S067",
        "S216",
        "S220"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Registry/supply chain",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": ""
    },
    {
      "claimId": "R4-CLM030",
      "packageClaimId": "CLM030",
      "claim": "The OWASP MCP Top 10 is in beta and should be described as a community framework rather than a final formal standard.",
      "dateRange": "2026-08-25",
      "specVersion": "v0.1 beta",
      "packageSourceIds": [
        "SEC027"
      ],
      "sourceIds": [
        "S190"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Governance/framework",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": ""
    },
    {
      "claimId": "R4-CLM031",
      "packageClaimId": "CLM031",
      "claim": "The NSA released MCP security design guidance on May 20, 2026.",
      "dateRange": "2026-05-20",
      "specVersion": "Pre-2026-07-28 GA",
      "packageSourceIds": [
        "SEC025",
        "SEC026"
      ],
      "sourceIds": [
        "S188",
        "S189"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Government guidance",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM032",
      "packageClaimId": "CLM032",
      "claim": "Session-specific security guidance written before July 28, 2026 must be qualified because current MCP removed protocol sessions.",
      "dateRange": "2026-07-28–present",
      "specVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC014",
        "SEC025"
      ],
      "sourceIds": [
        "S055",
        "S188"
      ],
      "confidence": "INFERRED",
      "affectedLayer": "Historical interpretation",
      "durability": "DURABLE",
      "notes": "The underlying threat may survive as application-state or handle risk."
    },
    {
      "claimId": "R4-CLM033",
      "packageClaimId": "CLM033",
      "claim": "A 2026 preprint identified 7,973 live remote MCP servers and reported 40.55% without authentication.",
      "dateRange": "Measurement period before 2026-07-28",
      "specVersion": "Measured ecosystem",
      "packageSourceIds": [
        "SEC037"
      ],
      "sourceIds": [
        "S196"
      ],
      "confidence": "VERIFIED_AS_AUTHOR_CLAIM",
      "affectedLayer": "Empirical ecosystem",
      "durability": "PERIODICALLY REVIEW",
      "notes": "Preprint; discovery method and definition of live server matter."
    },
    {
      "claimId": "R4-CLM034",
      "packageClaimId": "CLM034",
      "claim": "The same preprint dynamically tested 119 OAuth-enabled servers and found at least one flaw in each; this does not establish that all OAuth MCP servers were flawed.",
      "dateRange": "Measurement period before 2026-07-28",
      "specVersion": "Measured subset",
      "packageSourceIds": [
        "SEC037"
      ],
      "sourceIds": [
        "S196"
      ],
      "confidence": "VERIFIED_AS_AUTHOR_CLAIM",
      "affectedLayer": "Empirical ecosystem",
      "durability": "DURABLE",
      "notes": "Subset selection and preprint status must accompany the statistic."
    },
    {
      "claimId": "R4-CLM035",
      "packageClaimId": "CLM035",
      "claim": "VIPER-MCP reports 106 confirmed taint-style zero-days from 39,884 repositories and 67 CVE assignments; these are author-reported preprint results.",
      "dateRange": "2026-05/08",
      "specVersion": "Repository ecosystem",
      "packageSourceIds": [
        "SEC038"
      ],
      "sourceIds": [
        "S197"
      ],
      "confidence": "VERIFIED_AS_AUTHOR_CLAIM",
      "affectedLayer": "Empirical ecosystem",
      "durability": "PERIODICALLY REVIEW",
      "notes": "Do not treat repository count as active deployed servers."
    },
    {
      "claimId": "R4-CLM036",
      "packageClaimId": "CLM036",
      "claim": "A package download count is not a count of active developers or secure deployments.",
      "dateRange": "All",
      "specVersion": "Ecosystem",
      "packageSourceIds": [
        "SEC090",
        "SEC095"
      ],
      "sourceIds": [
        "S244",
        "S067"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Measurement",
      "durability": "DURABLE",
      "notes": "General package-statistics limitation."
    },
    {
      "claimId": "R4-CLM037",
      "packageClaimId": "CLM037",
      "claim": "User confirmation can fail when the UI hides full arguments, provenance or destination.",
      "dateRange": "2025–present",
      "specVersion": "Host-specific",
      "packageSourceIds": [
        "SEC035",
        "SEC039"
      ],
      "sourceIds": [
        "S108",
        "S198"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Host/UI",
      "durability": "DURABLE",
      "notes": "Confirmation quality matters, not just existence."
    },
    {
      "claimId": "R4-CLM038",
      "packageClaimId": "CLM038",
      "claim": "Least privilege must be enforced by the underlying system as well as the MCP server and host.",
      "dateRange": "All",
      "specVersion": "All",
      "packageSourceIds": [
        "SEC016",
        "SEC025"
      ],
      "sourceIds": [
        "S134",
        "S188"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Underlying system",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM039",
      "packageClaimId": "CLM039",
      "claim": "A read-only tool annotation does not replace database or API authorization.",
      "dateRange": "2025–present",
      "specVersion": "Tools",
      "packageSourceIds": [
        "SEC009",
        "SEC017"
      ],
      "sourceIds": [
        "S158",
        "S123"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server/underlying system",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM040",
      "packageClaimId": "CLM040",
      "claim": "Secure MCP deployment requires observability of identity, tool, authorization decision, outcome and latency without indiscriminate secret logging.",
      "dateRange": "2025–present",
      "specVersion": "All",
      "packageSourceIds": [
        "SEC016",
        "SEC025",
        "SEC027"
      ],
      "sourceIds": [
        "S134",
        "S188",
        "S190"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Operations",
      "durability": "PERIODICALLY REVIEW",
      "notes": ""
    },
    {
      "claimId": "R4-CLM041",
      "packageClaimId": "CLM041",
      "claim": "The current MCP roadmap names agent identity, enterprise-ready security and HTTP hardening as priorities.",
      "dateRange": "2026-08-22",
      "specVersion": "Post-2026-07-28",
      "packageSourceIds": [
        "SEC022"
      ],
      "sourceIds": [
        "S064"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Roadmap",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Roadmap priorities are not shipped features."
    },
    {
      "claimId": "R4-CLM042",
      "packageClaimId": "CLM042",
      "claim": "MCP is not a security boundary unless the host, server and deployment actually enforce policy at that boundary.",
      "dateRange": "All",
      "specVersion": "All",
      "packageSourceIds": [
        "SEC016",
        "SEC025"
      ],
      "sourceIds": [
        "S134",
        "S188"
      ],
      "confidence": "INFERRED",
      "affectedLayer": "Architecture",
      "durability": "DURABLE",
      "notes": "Analytical conclusion."
    },
    {
      "claimId": "R4-CLM043",
      "packageClaimId": "CLM043",
      "claim": "Authentication answers who is connecting; authorization answers what that identity may do.",
      "dateRange": "All",
      "specVersion": "All",
      "packageSourceIds": [
        "SEC015",
        "SEC025"
      ],
      "sourceIds": [
        "S133",
        "S188"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Identity",
      "durability": "DURABLE",
      "notes": "OAuth is primarily an authorization framework."
    },
    {
      "claimId": "R4-CLM044",
      "packageClaimId": "CLM044",
      "claim": "Remote MCP servers do not all need identical authentication; public read-only services, user-delegated SaaS services and service-to-service deployments have different models.",
      "dateRange": "2025–present",
      "specVersion": "Remote",
      "packageSourceIds": [
        "SEC015",
        "SEC016"
      ],
      "sourceIds": [
        "S133",
        "S134"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Authorization architecture",
      "durability": "DURABLE",
      "notes": "Authorization remains optional in spec, but exposure must match intended publicness."
    },
    {
      "claimId": "R4-CLM045",
      "packageClaimId": "CLM045",
      "claim": "A malicious server can be harmful even if its own tool is never invoked, because metadata may influence other tool choices.",
      "dateRange": "2025–present",
      "specVersion": "Multi-server hosts",
      "packageSourceIds": [
        "SEC035",
        "SEC042"
      ],
      "sourceIds": [
        "S108",
        "S201"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Model/host",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM046",
      "packageClaimId": "CLM046",
      "claim": "No single prompt-injection detector provides a complete defense; practical controls must limit capabilities and data flows after detection fails.",
      "dateRange": "2025–present",
      "specVersion": "All",
      "packageSourceIds": [
        "SEC039",
        "SEC044"
      ],
      "sourceIds": [
        "S198",
        "S203"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Model/data",
      "durability": "DURABLE",
      "notes": "Defense paper recall and false-positive trade-offs support layered controls."
    },
    {
      "claimId": "R4-CLM047",
      "packageClaimId": "CLM047",
      "claim": "Horizontal scalability improvements in 2026 reduce sticky-session requirements but do not by themselves ensure tenant isolation.",
      "dateRange": "2026-07-28–present",
      "specVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC014",
        "SEC060"
      ],
      "sourceIds": [
        "S055",
        "S147"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Infrastructure/multi-tenancy",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM048",
      "packageClaimId": "CLM048",
      "claim": "The security significance of an MCP CVE must identify the affected product and layer rather than implying all MCP implementations are affected.",
      "dateRange": "2025–present",
      "specVersion": "All",
      "packageSourceIds": [
        "SEC046",
        "SEC050",
        "SEC060",
        "SEC071"
      ],
      "sourceIds": [
        "S109",
        "S111",
        "S147",
        "S225"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Vulnerability classification",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM049",
      "packageClaimId": "CLM049",
      "claim": "Local and remote MCP have different dominant threat models; neither is universally safer.",
      "dateRange": "2024–present",
      "specVersion": "All",
      "packageSourceIds": [
        "SEC016",
        "SEC025",
        "SEC050",
        "SEC084"
      ],
      "sourceIds": [
        "S134",
        "S188",
        "S111",
        "S238"
      ],
      "confidence": "STRONGLY_SUPPORTED",
      "affectedLayer": "Architecture",
      "durability": "DURABLE",
      "notes": ""
    },
    {
      "claimId": "R4-CLM050",
      "packageClaimId": "CLM050",
      "claim": "Current security recommendations and affected-version ranges require live verification at publication.",
      "dateRange": "Current",
      "specVersion": "Current",
      "packageSourceIds": [
        "SEC014",
        "SEC015",
        "SEC016",
        "SEC046"
      ],
      "sourceIds": [
        "S055",
        "S133",
        "S134",
        "S109"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Editorial control",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": ""
    },
    {
      "claimId": "R4-CLM051",
      "packageClaimId": "CLM051",
      "claim": "MCP Inspector disclosed CVE-2025-49596: Remote code execution due to unauthenticated Inspector proxy",
      "dateRange": "2025-06-13",
      "specVersion": "<0.14.1",
      "packageSourceIds": [
        "SEC046"
      ],
      "sourceIds": [
        "S109"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/developer tool",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.14.1. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM052",
      "packageClaimId": "CLM052",
      "claim": "MCP Inspector disclosed CVE-2025-58444: Cross-site scripting in Inspector",
      "dateRange": "2025-09-05",
      "specVersion": "<0.16.6",
      "packageSourceIds": [
        "SEC047"
      ],
      "sourceIds": [
        "S110"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/developer tool",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.16.6. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM053",
      "packageClaimId": "CLM053",
      "claim": "MCP Python SDK disclosed CVE-2025-53366: Validation error amplification / denial of service",
      "dateRange": "2025-07-04",
      "specVersion": "<1.9.4",
      "packageSourceIds": [
        "SEC048"
      ],
      "sourceIds": [
        "S205"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.9.4. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM054",
      "packageClaimId": "CLM054",
      "claim": "MCP Python SDK disclosed CVE-2025-53365: Closed-resource handling denial of service",
      "dateRange": "2025-07-04",
      "specVersion": "<1.10.0",
      "packageSourceIds": [
        "SEC049"
      ],
      "sourceIds": [
        "S206"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.10.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM055",
      "packageClaimId": "CLM055",
      "claim": "MCP TypeScript SDK disclosed CVE-2025-66414: DNS rebinding protection disabled by default for unauthenticated localhost HTTP servers",
      "dateRange": "2025-12-02",
      "specVersion": "<1.24.0",
      "packageSourceIds": [
        "SEC050"
      ],
      "sourceIds": [
        "S111"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/transport",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.24.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM056",
      "packageClaimId": "CLM056",
      "claim": "MCP Python SDK disclosed CVE-2025-66416: DNS rebinding protection disabled by default for localhost HTTP servers",
      "dateRange": "2025-12-02",
      "specVersion": "<1.23.0",
      "packageSourceIds": [
        "SEC051"
      ],
      "sourceIds": [
        "S112"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/transport",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.23.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM057",
      "packageClaimId": "CLM057",
      "claim": "MCP Go SDK disclosed CVE-2026-34742: DNS rebinding protection gap for localhost HTTP servers",
      "dateRange": "2026-02-20",
      "specVersion": "<1.4.0",
      "packageSourceIds": [
        "SEC052"
      ],
      "sourceIds": [
        "S207"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/transport",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.4.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM058",
      "packageClaimId": "CLM058",
      "claim": "MCP Java SDK disclosed CVE-2026-35568: DNS rebinding protection gap for localhost HTTP servers",
      "dateRange": "2026-02-26",
      "specVersion": "<1.0.0",
      "packageSourceIds": [
        "SEC053"
      ],
      "sourceIds": [
        "S208"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/transport",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.0.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM059",
      "packageClaimId": "CLM059",
      "claim": "MCP Rust SDK disclosed CVE-2026-42559: DNS rebinding protection gap",
      "dateRange": "2026-04-14",
      "specVersion": "<1.4.0",
      "packageSourceIds": [
        "SEC054"
      ],
      "sourceIds": [
        "S209"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/transport",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.4.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM060",
      "packageClaimId": "CLM060",
      "claim": "MCP Ruby SDK disclosed CVE-2026-63118: DNS rebinding protection gap",
      "dateRange": "2026-06-08",
      "specVersion": "<=0.22.0",
      "packageSourceIds": [
        "SEC055"
      ],
      "sourceIds": [
        "S210"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/transport",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.23.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM061",
      "packageClaimId": "CLM061",
      "claim": "MCP Ruby SDK disclosed CVE-2026-67431: Protocol-session poisoning / state confusion in legacy session architecture",
      "dateRange": "2026-06-24",
      "specVersion": "<=0.22.0",
      "packageSourceIds": [
        "SEC056"
      ],
      "sourceIds": [
        "S211"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/session",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.23.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM062",
      "packageClaimId": "CLM062",
      "claim": "MCP Ruby SDK disclosed CVE-2026-67430: Unbounded stdio message handling can exhaust resources",
      "dateRange": "2026-06-24",
      "specVersion": "LIVE-CHECK REQUIRED",
      "packageSourceIds": [
        "SEC057"
      ],
      "sourceIds": [
        "S212"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/stdio",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.23.0 reported. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM063",
      "packageClaimId": "CLM063",
      "claim": "MCP Ruby SDK disclosed CVE-2026-67432: Legacy session retention / cleanup flaw",
      "dateRange": "2026-06-24",
      "specVersion": "LIVE-CHECK REQUIRED",
      "packageSourceIds": [
        "SEC058"
      ],
      "sourceIds": [
        "S213"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/session",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.23.0 reported. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM064",
      "packageClaimId": "CLM064",
      "claim": "MCP TypeScript SDK disclosed CVE-2026-0621: UriTemplate regular-expression denial of service",
      "dateRange": "2026-01-08",
      "specVersion": "<1.25.2",
      "packageSourceIds": [
        "SEC059"
      ],
      "sourceIds": [
        "S214"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/parser",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.25.2. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM065",
      "packageClaimId": "CLM065",
      "claim": "MCP TypeScript SDK disclosed CVE-2026-25536: Cross-client response data leakage when server/transport instances are reused",
      "dateRange": "2026-02-06",
      "specVersion": "1.10.0–1.25.3",
      "packageSourceIds": [
        "SEC060"
      ],
      "sourceIds": [
        "S147"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "SDK/multi-tenancy",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.26.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM066",
      "packageClaimId": "CLM066",
      "claim": "MCP reference Git server disclosed CVE-2025-68143: Repository path validation weakness",
      "dateRange": "2025-10-16",
      "specVersion": "<2025.9.25",
      "packageSourceIds": [
        "SEC061"
      ],
      "sourceIds": [
        "S215"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server implementation",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 2025.9.25 / server removed. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM067",
      "packageClaimId": "CLM067",
      "claim": "Official MCP Registry disclosed CVE-2026-44430: Server-side request forgery in registry processing",
      "dateRange": "2026-04-29",
      "specVersion": "<1.7.7",
      "packageSourceIds": [
        "SEC062"
      ],
      "sourceIds": [
        "S216"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Registry",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.7.7. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM068",
      "packageClaimId": "CLM068",
      "claim": "Official MCP Registry disclosed CVE-2026-44428: OIDC token replay / validation flaw",
      "dateRange": "2026-04-29",
      "specVersion": "<1.7.6",
      "packageSourceIds": [
        "SEC063"
      ],
      "sourceIds": [
        "S217"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Registry/auth",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.7.6. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM069",
      "packageClaimId": "CLM069",
      "claim": "Official MCP Registry disclosed CVE-2026-44427: Open redirect",
      "dateRange": "2026-04-29",
      "specVersion": ">=1.1.0,<1.7.5",
      "packageSourceIds": [
        "SEC064"
      ],
      "sourceIds": [
        "S218"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Registry/web",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.7.5. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM070",
      "packageClaimId": "CLM070",
      "claim": "Official MCP Registry disclosed GHSA-rqv2-m695-f8j4: Stored cross-site scripting",
      "dateRange": "2026-05-01",
      "specVersion": "LIVE-CHECK REQUIRED",
      "packageSourceIds": [
        "SEC065"
      ],
      "sourceIds": [
        "S219"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Registry/web",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: LIVE-CHECK REQUIRED. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM071",
      "packageClaimId": "CLM071",
      "claim": "Official MCP Registry disclosed GHSA-2v5f-5r6w-p67r: OCI verification fail-open behavior",
      "dateRange": "2026-05-01",
      "specVersion": "<1.7.9",
      "packageSourceIds": [
        "SEC066"
      ],
      "sourceIds": [
        "S220"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Registry/supply chain",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.7.9. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM072",
      "packageClaimId": "CLM072",
      "claim": "Microsoft Playwright MCP disclosed CVE-2025-9611: DNS rebinding against localhost HTTP mode",
      "dateRange": "2025-08-29",
      "specVersion": "<0.0.40",
      "packageSourceIds": [
        "SEC067"
      ],
      "sourceIds": [
        "S221"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server/transport",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.0.40. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM073",
      "packageClaimId": "CLM073",
      "claim": "Google MCP Toolbox for Databases disclosed CVE-2026-9739: DNS rebinding in legacy SSE/local deployment",
      "dateRange": "2026-08-07",
      "specVersion": "<1.2.0",
      "packageSourceIds": [
        "SEC068"
      ],
      "sourceIds": [
        "S222"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server/transport",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.2.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM074",
      "packageClaimId": "CLM074",
      "claim": "CircleCI MCP Server disclosed GHSA-jwj7-74jh-p5c4: DNS rebinding protection weakness",
      "dateRange": "2026-03-03",
      "specVersion": "<0.17.0",
      "packageSourceIds": [
        "SEC069"
      ],
      "sourceIds": [
        "S223"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server/transport",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.17.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM075",
      "packageClaimId": "CLM075",
      "claim": "MCPJam Inspector disclosed CVE-2026-23744: Remote command execution",
      "dateRange": "2026-01-16",
      "specVersion": "<=1.4.2",
      "packageSourceIds": [
        "SEC070"
      ],
      "sourceIds": [
        "S224"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/developer tool",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.4.3. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM076",
      "packageClaimId": "CLM076",
      "claim": "FastMCP disclosed CVE-2026-27124: OAuth proxy callback missing consent binding; confused deputy",
      "dateRange": "2026-04-03",
      "specVersion": "<3.2.0",
      "packageSourceIds": [
        "SEC071"
      ],
      "sourceIds": [
        "S225"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Framework/auth",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 3.2.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM077",
      "packageClaimId": "CLM077",
      "claim": "mcp-pinot disclosed CVE-2026-49257: Network service bound broadly without authentication",
      "dateRange": "2026-05-20",
      "specVersion": "<=3.0.1",
      "packageSourceIds": [
        "SEC072"
      ],
      "sourceIds": [
        "S226"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server/deployment",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 3.1.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM078",
      "packageClaimId": "CLM078",
      "claim": "GitHub MCP Server disclosed CVE-2026-47427: Nil-pointer denial of service",
      "dateRange": "2026-04-20",
      "specVersion": "<1.1.0",
      "packageSourceIds": [
        "SEC073"
      ],
      "sourceIds": [
        "S227"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server implementation",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.1.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM079",
      "packageClaimId": "CLM079",
      "claim": "GitHub MCP Server disclosed CVE-2026-48529: Lockdown mode cross-user authorization separation flaw",
      "dateRange": "2026-05-16",
      "specVersion": ">=0.22.0,<1.1.2",
      "packageSourceIds": [
        "SEC074"
      ],
      "sourceIds": [
        "S228"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server/authorization",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.1.2. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM080",
      "packageClaimId": "CLM080",
      "claim": "Kubernetes MCP Server disclosed CVE-2026-46519: Presentation-only authorization without server-side enforcement",
      "dateRange": "2026-05-04",
      "specVersion": "<3.6.0",
      "packageSourceIds": [
        "SEC075"
      ],
      "sourceIds": [
        "S229"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server/authorization",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 3.6.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM081",
      "packageClaimId": "CLM081",
      "claim": "flyto-core disclosed CVE-2026-55786: Unauthenticated command execution through MCP capability",
      "dateRange": "2026-05-29",
      "specVersion": ">=2.26.2,<2.26.4",
      "packageSourceIds": [
        "SEC076"
      ],
      "sourceIds": [
        "S230"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server implementation",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 2.26.4. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM082",
      "packageClaimId": "CLM082",
      "claim": "MySQL MCP Server disclosed CVE-2026-11529: SQL injection through insufficient input handling",
      "dateRange": "2026-01-15",
      "specVersion": "<0.3.0",
      "packageSourceIds": [
        "SEC077"
      ],
      "sourceIds": [
        "S231"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server implementation",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.3.0. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM083",
      "packageClaimId": "CLM083",
      "claim": "aws-mcp disclosed CVE-2026-5059: Command injection",
      "dateRange": "2026-05-22",
      "specVersion": "<=1.7.0",
      "packageSourceIds": [
        "SEC078"
      ],
      "sourceIds": [
        "S232"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server implementation",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: No patch listed when recorded. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM084",
      "packageClaimId": "CLM084",
      "claim": "Claude Code Action disclosed CVE-2026-47751: Malicious repository .mcp.json can execute configured server code",
      "dateRange": "2026-05-09",
      "specVersion": "<1.0.74",
      "packageSourceIds": [
        "SEC079"
      ],
      "sourceIds": [
        "S233"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/project config",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 1.0.74. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM085",
      "packageClaimId": "CLM085",
      "claim": "Apify MCP Server disclosed CVE-2026-50143: Path/token authorization weakness",
      "dateRange": "2026-05-25",
      "specVersion": "<0.10.11",
      "packageSourceIds": [
        "SEC080"
      ],
      "sourceIds": [
        "S234"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server/authorization",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.10.11. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM086",
      "packageClaimId": "CLM086",
      "claim": "LibreChat disclosed CVE-2026-31944: OAuth callback binding/account-linking weakness",
      "dateRange": "2026-03-24",
      "specVersion": "LIVE-CHECK REQUIRED",
      "packageSourceIds": [
        "SEC081"
      ],
      "sourceIds": [
        "S235"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/auth",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.8.3-rc1 reported. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM087",
      "packageClaimId": "CLM087",
      "claim": "LibreChat disclosed CVE-2026-32625: Environment-expanded MCP URL can expose secrets",
      "dateRange": "2026-03-26",
      "specVersion": "<=0.8.3",
      "packageSourceIds": [
        "SEC082"
      ],
      "sourceIds": [
        "S236"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/configuration",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.8.4-rc1 reported. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM088",
      "packageClaimId": "CLM088",
      "claim": "LibreChat disclosed GHSA-pmw7-gqwj-f954: Attacker-controlled headers can expose tokens",
      "dateRange": "2026-03-26",
      "specVersion": ">=0.8.2-rc1,<=0.8.3-rc1",
      "packageSourceIds": [
        "SEC083"
      ],
      "sourceIds": [
        "S237"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/auth",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: >=0.8.3-rc2. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM089",
      "packageClaimId": "CLM089",
      "claim": "PraisonAI disclosed CVE-2026-40159: Environment variables inherited by local MCP processes",
      "dateRange": "2026-04-01",
      "specVersion": "<4.5.128",
      "packageSourceIds": [
        "SEC084"
      ],
      "sourceIds": [
        "S238"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/local process",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 4.5.128. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM090",
      "packageClaimId": "CLM090",
      "claim": "PraisonAI disclosed CVE-2026-41497: Unsafe command parsing for MCP server configuration",
      "dateRange": "2026-04-10",
      "specVersion": "<=4.5.148",
      "packageSourceIds": [
        "SEC085"
      ],
      "sourceIds": [
        "S239"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/local process",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: Patched after 4.5.148. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM091",
      "packageClaimId": "CLM091",
      "claim": "PraisonAI disclosed CVE-2026-57124: Unauthenticated remote MCP connect path",
      "dateRange": "2026-06-01",
      "specVersion": "<=4.6.48",
      "packageSourceIds": [
        "SEC086"
      ],
      "sourceIds": [
        "S240"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/network",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 4.6.59. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM092",
      "packageClaimId": "CLM092",
      "claim": "PraisonAI disclosed CVE-2026-47394: Arbitrary local file read through MCP integration",
      "dateRange": "2026-05-12",
      "specVersion": "<=4.6.39",
      "packageSourceIds": [
        "SEC087"
      ],
      "sourceIds": [
        "S241"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/server",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 4.6.40. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM093",
      "packageClaimId": "CLM093",
      "claim": "Nginx UI MCP integration disclosed CVE-2026-33032: Unauthenticated MCP endpoint enabling administrative takeover",
      "dateRange": "2026-03-15",
      "specVersion": "<=2.3.3 reported",
      "packageSourceIds": [
        "SEC088"
      ],
      "sourceIds": [
        "S242"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Server/product integration",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 2.3.4 reported. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM094",
      "packageClaimId": "CLM094",
      "claim": "mcp-remote disclosed CVE-2025-6514: Command injection in remote-server launcher",
      "dateRange": "2025-07-09",
      "specVersion": "LIVE-CHECK REQUIRED",
      "packageSourceIds": [
        "SEC089"
      ],
      "sourceIds": [
        "S243"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Launcher/supply chain",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: LIVE-CHECK REQUIRED. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM095",
      "packageClaimId": "CLM095",
      "claim": "Postmark MCP impersonator disclosed MALICIOUS-PACKAGE: Malicious npm package impersonating an official server and exfiltrating API keys",
      "dateRange": "2026-01-23",
      "specVersion": ">=1.0.16 malicious series",
      "packageSourceIds": [
        "SEC090"
      ],
      "sourceIds": [
        "S244"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Supply chain",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: Remove package; use verified vendor source. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM096",
      "packageClaimId": "CLM096",
      "claim": "Cursor disclosed CVE-2025-64109: Malicious project MCP configuration can trigger code execution",
      "dateRange": "2025-09-17",
      "specVersion": "Before 2025.09.17-25b418f",
      "packageSourceIds": [
        "SEC091"
      ],
      "sourceIds": [
        "S245"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/project config",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 2025.09.17-25b418f. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM097",
      "packageClaimId": "CLM097",
      "claim": "Zed disclosed CVE-2025-68433: Malicious project MCP configuration can trigger code execution",
      "dateRange": "2025-12-19",
      "specVersion": "<0.218.2-pre",
      "packageSourceIds": [
        "SEC092"
      ],
      "sourceIds": [
        "S246"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/project config",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 0.218.2-pre. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    },
    {
      "claimId": "R4-CLM098",
      "packageClaimId": "CLM098",
      "claim": "OpenClaw disclosed CVE-2026-44118: Owner identity spoofing in MCP-connected workflow",
      "dateRange": "2026-04-22",
      "specVersion": "<=2026.4.21",
      "packageSourceIds": [
        "SEC093"
      ],
      "sourceIds": [
        "S247"
      ],
      "confidence": "VERIFIED",
      "affectedLayer": "Host/identity",
      "durability": "LIVE-CHECK REQUIRED",
      "notes": "Patched/fixed: 2026.4.22. This is an implementation/ecosystem advisory, not automatically a core-protocol flaw."
    }
  ]
}