{
  "title": "MCP Security — Ranked Supporting Content Plan",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-25",
  "protocolRevision": "2026-07-28",
  "rankingNote": "The package supplies an ordinal rank, not P0/P1/P2 priorities. The normalized priority field preserves that rank without inventing tiers.",
  "publicationNote": "Planned briefs are not permission to publish thin pages; each must pass evidence and cannibalization review.",
  "count": 71,
  "records": [
    {
      "rank": 1,
      "title": "MCP OAuth Explained",
      "url": "/mcp-oauth/",
      "searchIntent": "Understand current MCP authorization flow",
      "packageSourceIds": [
        "SEC015",
        "SEC028",
        "SEC029",
        "SEC030",
        "SEC031",
        "SEC032"
      ],
      "sourceIds": [
        "S133",
        "S191",
        "S006",
        "S005",
        "S192",
        "S004"
      ],
      "parentPage": "/mcp-security/",
      "justification": "High-intent identity query with version-sensitive requirements",
      "priority": "Rank 1",
      "publicationStatus": "planned"
    },
    {
      "rank": 2,
      "title": "MCP Authentication vs Authorization",
      "url": "/mcp-authentication-vs-authorization/",
      "searchIntent": "Differentiate identity from permissions",
      "packageSourceIds": [
        "SEC015",
        "SEC025"
      ],
      "sourceIds": [
        "S133",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Common conceptual confusion",
      "priority": "Rank 2",
      "publicationStatus": "planned"
    },
    {
      "rank": 3,
      "title": "MCP Tool Poisoning",
      "url": "/mcp-tool-poisoning/",
      "searchIntent": "Understand poisoned metadata, shadowing and rug pulls",
      "packageSourceIds": [
        "SEC035",
        "SEC039",
        "SEC041"
      ],
      "sourceIds": [
        "S108",
        "S198",
        "S200"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Distinct security research intent",
      "priority": "Rank 3",
      "publicationStatus": "planned"
    },
    {
      "rank": 4,
      "title": "MCP Prompt Injection",
      "url": "/mcp-prompt-injection/",
      "searchIntent": "Understand untrusted resources and tool output",
      "packageSourceIds": [
        "SEC039",
        "SEC044"
      ],
      "sourceIds": [
        "S198",
        "S203"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Broader than tool poisoning",
      "priority": "Rank 4",
      "publicationStatus": "planned"
    },
    {
      "rank": 5,
      "title": "MCP Supply-Chain Security",
      "url": "/mcp-supply-chain-security/",
      "searchIntent": "Evaluate packages, publishers, registries and updates",
      "packageSourceIds": [
        "SEC038",
        "SEC090",
        "SEC095"
      ],
      "sourceIds": [
        "S197",
        "S244",
        "S067"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Operational and compliance intent",
      "priority": "Rank 5",
      "publicationStatus": "planned"
    },
    {
      "rank": 6,
      "title": "Malicious MCP Servers",
      "url": "/malicious-mcp-servers/",
      "searchIntent": "Recognize hostile server behavior",
      "packageSourceIds": [
        "SEC035",
        "SEC090"
      ],
      "sourceIds": [
        "S108",
        "S244"
      ],
      "parentPage": "/mcp-security/",
      "justification": "User safety search intent",
      "priority": "Rank 6",
      "publicationStatus": "planned"
    },
    {
      "rank": 7,
      "title": "Local MCP Server Security",
      "url": "/local-mcp-server-security/",
      "searchIntent": "Secure stdio, processes, files and environment",
      "packageSourceIds": [
        "SEC016",
        "SEC050",
        "SEC084"
      ],
      "sourceIds": [
        "S134",
        "S111",
        "S238"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Distinct local deployment intent",
      "priority": "Rank 7",
      "publicationStatus": "planned"
    },
    {
      "rank": 8,
      "title": "Remote MCP Server Security",
      "url": "/remote-mcp-server-security/",
      "searchIntent": "Secure HTTP, OAuth and tenancy",
      "packageSourceIds": [
        "SEC015",
        "SEC016",
        "SEC037"
      ],
      "sourceIds": [
        "S133",
        "S134",
        "S196"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Distinct remote deployment intent",
      "priority": "Rank 8",
      "publicationStatus": "planned"
    },
    {
      "rank": 9,
      "title": "MCP DNS Rebinding",
      "url": "/mcp-dns-rebinding/",
      "searchIntent": "Understand localhost HTTP attack and patches",
      "packageSourceIds": [
        "SEC050",
        "SEC051",
        "SEC052",
        "SEC053",
        "SEC054",
        "SEC055"
      ],
      "sourceIds": [
        "S111",
        "S112",
        "S207",
        "S208",
        "S209",
        "S210"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Multiple official SDK advisories",
      "priority": "Rank 9",
      "publicationStatus": "planned"
    },
    {
      "rank": 10,
      "title": "MCP Confused Deputy Attacks",
      "url": "/mcp-confused-deputy/",
      "searchIntent": "Understand token, consent and proxy confusion",
      "packageSourceIds": [
        "SEC016",
        "SEC071"
      ],
      "sourceIds": [
        "S134",
        "S225"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Important OAuth-specific risk",
      "priority": "Rank 10",
      "publicationStatus": "planned"
    },
    {
      "rank": 11,
      "title": "MCP Token Passthrough",
      "url": "/mcp-token-passthrough/",
      "searchIntent": "Why forwarding tokens is unsafe",
      "packageSourceIds": [
        "SEC016",
        "SEC015"
      ],
      "sourceIds": [
        "S134",
        "S133"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Direct official anti-pattern",
      "priority": "Rank 11",
      "publicationStatus": "planned"
    },
    {
      "rank": 12,
      "title": "MCP Secrets and Environment Variables",
      "url": "/mcp-secrets-environment-variables/",
      "searchIntent": "Protect local and remote credentials",
      "packageSourceIds": [
        "SEC016",
        "SEC084"
      ],
      "sourceIds": [
        "S134",
        "S238"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Practical developer query",
      "priority": "Rank 12",
      "publicationStatus": "planned"
    },
    {
      "rank": 13,
      "title": "MCP Server Sandboxing",
      "url": "/mcp-server-sandboxing/",
      "searchIntent": "Constrain local process authority",
      "packageSourceIds": [
        "SEC016",
        "SEC025"
      ],
      "sourceIds": [
        "S134",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Implementation-focused security intent",
      "priority": "Rank 13",
      "publicationStatus": "planned"
    },
    {
      "rank": 14,
      "title": "MCP Gateway Security",
      "url": "/mcp-gateway-security/",
      "searchIntent": "Centralize policy without overstating gateway guarantees",
      "packageSourceIds": [
        "SEC016",
        "SEC025"
      ],
      "sourceIds": [
        "S134",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Enterprise product and architecture intent",
      "priority": "Rank 14",
      "publicationStatus": "planned"
    },
    {
      "rank": 15,
      "title": "Enterprise MCP Security",
      "url": "/enterprise-mcp-security/",
      "searchIntent": "Identity, SSO, catalogs, audit and policy",
      "packageSourceIds": [
        "SEC022",
        "SEC025"
      ],
      "sourceIds": [
        "S064",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "High-value enterprise intent",
      "priority": "Rank 15",
      "publicationStatus": "planned"
    },
    {
      "rank": 16,
      "title": "MCP Security Checklist",
      "url": "/mcp-security-checklist/",
      "searchIntent": "Operational pre-deployment and review checklist",
      "packageSourceIds": [
        "SEC016",
        "SEC025"
      ],
      "sourceIds": [
        "S134",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Snippet and utility potential",
      "priority": "Rank 16",
      "publicationStatus": "planned"
    },
    {
      "rank": 17,
      "title": "MCP CVE Database",
      "url": "/mcp-cve-database/",
      "searchIntent": "Track current vulnerabilities by component and fixed version",
      "packageSourceIds": [
        "SEC046",
        "SEC050",
        "SEC060"
      ],
      "sourceIds": [
        "S109",
        "S111",
        "S147"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Requires database-style live maintenance",
      "priority": "Rank 17",
      "publicationStatus": "planned"
    },
    {
      "rank": 18,
      "title": "MCP Apps Security",
      "url": "/mcp-apps-security/",
      "searchIntent": "Secure server-provided interactive UI",
      "packageSourceIds": [
        "SEC020"
      ],
      "sourceIds": [
        "S136"
      ],
      "parentPage": "/mcp-security/",
      "justification": "New extension-specific intent",
      "priority": "Rank 18",
      "publicationStatus": "planned"
    },
    {
      "rank": 19,
      "title": "MCP Tasks Security",
      "url": "/mcp-tasks-security/",
      "searchIntent": "Secure long-running work and task handles",
      "packageSourceIds": [
        "SEC021"
      ],
      "sourceIds": [
        "S137"
      ],
      "parentPage": "/mcp-security/",
      "justification": "New extension-specific intent",
      "priority": "Rank 19",
      "publicationStatus": "planned"
    },
    {
      "rank": 20,
      "title": "MCP Authorization History",
      "url": "/mcp-authorization-history/",
      "searchIntent": "Trace no-core-auth to current CIMD/issuer model",
      "packageSourceIds": [
        "SEC002",
        "SEC007",
        "SEC010",
        "SEC012",
        "SEC014"
      ],
      "sourceIds": [
        "S024",
        "S036",
        "S043",
        "S049",
        "S055"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Historical authority and version confusion",
      "priority": "Rank 20",
      "publicationStatus": "planned"
    },
    {
      "rank": 21,
      "title": "MCP Resource Indicators",
      "url": "/mcp-resource-indicators/",
      "searchIntent": "Bind tokens to target servers",
      "packageSourceIds": [
        "SEC015",
        "SEC030"
      ],
      "sourceIds": [
        "S133",
        "S005"
      ],
      "parentPage": "/mcp-oauth/",
      "justification": "Narrow but important OAuth implementation intent",
      "priority": "Rank 21",
      "publicationStatus": "planned"
    },
    {
      "rank": 22,
      "title": "MCP Protected Resource Metadata",
      "url": "/mcp-protected-resource-metadata/",
      "searchIntent": "Implement RFC 9728 discovery",
      "packageSourceIds": [
        "SEC015",
        "SEC029"
      ],
      "sourceIds": [
        "S133",
        "S006"
      ],
      "parentPage": "/mcp-oauth/",
      "justification": "Implementation search intent",
      "priority": "Rank 22",
      "publicationStatus": "planned"
    },
    {
      "rank": 23,
      "title": "MCP Client ID Metadata Documents",
      "url": "/mcp-client-id-metadata-documents/",
      "searchIntent": "Understand current preferred registration",
      "packageSourceIds": [
        "SEC014",
        "SEC015"
      ],
      "sourceIds": [
        "S055",
        "S133"
      ],
      "parentPage": "/mcp-oauth/",
      "justification": "Current spec freshness opportunity",
      "priority": "Rank 23",
      "publicationStatus": "planned"
    },
    {
      "rank": 24,
      "title": "MCP Dynamic Client Registration",
      "url": "/mcp-dynamic-client-registration/",
      "searchIntent": "Explain history and deprecation",
      "packageSourceIds": [
        "SEC014",
        "SEC034",
        "SEC037"
      ],
      "sourceIds": [
        "S055",
        "S194",
        "S196"
      ],
      "parentPage": "/mcp-oauth/",
      "justification": "High-interest due measured flaws and deprecation",
      "priority": "Rank 24",
      "publicationStatus": "planned"
    },
    {
      "rank": 25,
      "title": "MCP PKCE",
      "url": "/mcp-pkce/",
      "searchIntent": "Secure public-client authorization code flow",
      "packageSourceIds": [
        "SEC015",
        "SEC032"
      ],
      "sourceIds": [
        "S133",
        "S004"
      ],
      "parentPage": "/mcp-oauth/",
      "justification": "OAuth implementation query",
      "priority": "Rank 25",
      "publicationStatus": "planned"
    },
    {
      "rank": 26,
      "title": "MCP Issuer Validation",
      "url": "/mcp-issuer-validation/",
      "searchIntent": "Prevent mix-up and credential misbinding",
      "packageSourceIds": [
        "SEC014",
        "SEC015",
        "SEC031"
      ],
      "sourceIds": [
        "S055",
        "S133",
        "S192"
      ],
      "parentPage": "/mcp-oauth/",
      "justification": "New 2026 hardening detail",
      "priority": "Rank 26",
      "publicationStatus": "planned"
    },
    {
      "rank": 27,
      "title": "MCP OAuth SSRF",
      "url": "/mcp-oauth-ssrf/",
      "searchIntent": "Secure metadata and URL fetching",
      "packageSourceIds": [
        "SEC016"
      ],
      "sourceIds": [
        "S134"
      ],
      "parentPage": "/mcp-oauth/",
      "justification": "Concrete implementation risk",
      "priority": "Rank 27",
      "publicationStatus": "planned"
    },
    {
      "rank": 28,
      "title": "MCP Tool Shadowing",
      "url": "/mcp-tool-shadowing/",
      "searchIntent": "Cross-server semantic attack",
      "packageSourceIds": [
        "SEC035",
        "SEC041"
      ],
      "sourceIds": [
        "S108",
        "S200"
      ],
      "parentPage": "/mcp-tool-poisoning/",
      "justification": "Distinct technique and search intent",
      "priority": "Rank 28",
      "publicationStatus": "planned"
    },
    {
      "rank": 29,
      "title": "MCP Rug Pull Attacks",
      "url": "/mcp-rug-pull/",
      "searchIntent": "Definition drift after approval",
      "packageSourceIds": [
        "SEC035",
        "SEC041"
      ],
      "sourceIds": [
        "S108",
        "S200"
      ],
      "parentPage": "/mcp-tool-poisoning/",
      "justification": "Supply-chain and semantic overlap",
      "priority": "Rank 29",
      "publicationStatus": "planned"
    },
    {
      "rank": 30,
      "title": "MCP Tool Definition Integrity",
      "url": "/mcp-tool-definition-integrity/",
      "searchIntent": "Pin, sign and diff tool metadata",
      "packageSourceIds": [
        "SEC035",
        "SEC041"
      ],
      "sourceIds": [
        "S108",
        "S200"
      ],
      "parentPage": "/mcp-tool-poisoning/",
      "justification": "Practical control page",
      "priority": "Rank 30",
      "publicationStatus": "planned"
    },
    {
      "rank": 31,
      "title": "MCP Tool Annotations Security",
      "url": "/mcp-tool-annotations-security/",
      "searchIntent": "Why hints are not guarantees",
      "packageSourceIds": [
        "SEC009",
        "SEC017"
      ],
      "sourceIds": [
        "S158",
        "S123"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Protocol-specific misconception",
      "priority": "Rank 31",
      "publicationStatus": "planned"
    },
    {
      "rank": 32,
      "title": "MCP User Consent",
      "url": "/mcp-user-consent-security/",
      "searchIntent": "Design meaningful confirmations",
      "packageSourceIds": [
        "SEC004",
        "SEC035",
        "SEC039"
      ],
      "sourceIds": [
        "S028",
        "S108",
        "S198"
      ],
      "parentPage": "/mcp-security/",
      "justification": "UX/security intersection",
      "priority": "Rank 32",
      "publicationStatus": "planned"
    },
    {
      "rank": 33,
      "title": "MCP Data Exfiltration",
      "url": "/mcp-data-exfiltration/",
      "searchIntent": "Map paths through tools, resources and output",
      "packageSourceIds": [
        "SEC035",
        "SEC039"
      ],
      "sourceIds": [
        "S108",
        "S198"
      ],
      "parentPage": "/mcp-security/",
      "justification": "High-interest incident intent",
      "priority": "Rank 33",
      "publicationStatus": "planned"
    },
    {
      "rank": 34,
      "title": "MCP Cross-Client Data Leakage",
      "url": "/mcp-cross-client-data-leakage/",
      "searchIntent": "Prevent shared-state tenant bleed",
      "packageSourceIds": [
        "SEC060"
      ],
      "sourceIds": [
        "S147"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Concrete advisory and architecture lesson",
      "priority": "Rank 34",
      "publicationStatus": "planned"
    },
    {
      "rank": 35,
      "title": "MCP State Handle Security",
      "url": "/mcp-state-handle-security/",
      "searchIntent": "Secure post-session explicit state",
      "packageSourceIds": [
        "SEC014",
        "SEC016",
        "SEC017"
      ],
      "sourceIds": [
        "S055",
        "S134",
        "S123"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Current 2026 protocol opportunity",
      "priority": "Rank 35",
      "publicationStatus": "planned"
    },
    {
      "rank": 36,
      "title": "MCP Cache Security",
      "url": "/mcp-cache-security/",
      "searchIntent": "Secure cacheScope and authorization keys",
      "packageSourceIds": [
        "SEC014",
        "SEC016"
      ],
      "sourceIds": [
        "S055",
        "S134"
      ],
      "parentPage": "/mcp-security/",
      "justification": "New 2026 infrastructure topic",
      "priority": "Rank 36",
      "publicationStatus": "planned"
    },
    {
      "rank": 37,
      "title": "MCP Routing Header Security",
      "url": "/mcp-routing-header-security/",
      "searchIntent": "Validate Mcp-Method and Mcp-Name",
      "packageSourceIds": [
        "SEC014",
        "SEC018"
      ],
      "sourceIds": [
        "S055",
        "S057"
      ],
      "parentPage": "/mcp-security/",
      "justification": "New 2026 infrastructure topic",
      "priority": "Rank 37",
      "publicationStatus": "planned"
    },
    {
      "rank": 38,
      "title": "MCP Multi-Tenancy Security",
      "url": "/mcp-multi-tenancy-security/",
      "searchIntent": "Separate users, transports, caches and credentials",
      "packageSourceIds": [
        "SEC060",
        "SEC016"
      ],
      "sourceIds": [
        "S147",
        "S134"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Enterprise SaaS intent",
      "priority": "Rank 38",
      "publicationStatus": "planned"
    },
    {
      "rank": 39,
      "title": "MCP Audit Logging",
      "url": "/mcp-audit-logging/",
      "searchIntent": "Log actions without leaking secrets",
      "packageSourceIds": [
        "SEC025",
        "SEC027"
      ],
      "sourceIds": [
        "S188",
        "S190"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Compliance and operations intent",
      "priority": "Rank 39",
      "publicationStatus": "planned"
    },
    {
      "rank": 40,
      "title": "MCP Observability",
      "url": "/mcp-observability-security/",
      "searchIntent": "Trace identity, policy and effects",
      "packageSourceIds": [
        "SEC014",
        "SEC025"
      ],
      "sourceIds": [
        "S055",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Operations intent",
      "priority": "Rank 40",
      "publicationStatus": "planned"
    },
    {
      "rank": 41,
      "title": "MCP Rate Limiting and DoS",
      "url": "/mcp-rate-limiting-dos/",
      "searchIntent": "Bound requests and expensive tools",
      "packageSourceIds": [
        "SEC048",
        "SEC049",
        "SEC057",
        "SEC059"
      ],
      "sourceIds": [
        "S205",
        "S206",
        "S212",
        "S214"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Multiple advisories",
      "priority": "Rank 41",
      "publicationStatus": "planned"
    },
    {
      "rank": 42,
      "title": "MCP Command Injection",
      "url": "/mcp-command-injection/",
      "searchIntent": "Prevent tool arguments reaching shells",
      "packageSourceIds": [
        "SEC038",
        "SEC078"
      ],
      "sourceIds": [
        "S197",
        "S232"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Specific vulnerability class",
      "priority": "Rank 42",
      "publicationStatus": "planned"
    },
    {
      "rank": 43,
      "title": "MCP SQL Injection",
      "url": "/mcp-sql-injection/",
      "searchIntent": "Secure database servers",
      "packageSourceIds": [
        "SEC077",
        "SEC038"
      ],
      "sourceIds": [
        "S231",
        "S197"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Database security intent",
      "priority": "Rank 43",
      "publicationStatus": "planned"
    },
    {
      "rank": 44,
      "title": "MCP Filesystem Security",
      "url": "/mcp-filesystem-security/",
      "searchIntent": "Path controls, symlinks and least privilege",
      "packageSourceIds": [
        "SEC016",
        "SEC061"
      ],
      "sourceIds": [
        "S134",
        "S215"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Early and common server category",
      "priority": "Rank 44",
      "publicationStatus": "planned"
    },
    {
      "rank": 45,
      "title": "MCP Browser Automation Security",
      "url": "/mcp-browser-automation-security/",
      "searchIntent": "Secure high-authority browser tools",
      "packageSourceIds": [
        "SEC067",
        "SEC035"
      ],
      "sourceIds": [
        "S221",
        "S108"
      ],
      "parentPage": "/mcp-security/",
      "justification": "High-risk use case",
      "priority": "Rank 45",
      "publicationStatus": "planned"
    },
    {
      "rank": 46,
      "title": "MCP Kubernetes Security",
      "url": "/mcp-kubernetes-security/",
      "searchIntent": "Enforce server-side cluster authorization",
      "packageSourceIds": [
        "SEC075"
      ],
      "sourceIds": [
        "S229"
      ],
      "parentPage": "/mcp-security/",
      "justification": "High-value infrastructure intent",
      "priority": "Rank 46",
      "publicationStatus": "planned"
    },
    {
      "rank": 47,
      "title": "MCP Database Security",
      "url": "/mcp-database-security/",
      "searchIntent": "Read-only roles, query controls and tenant checks",
      "packageSourceIds": [
        "SEC077",
        "SEC016"
      ],
      "sourceIds": [
        "S231",
        "S134"
      ],
      "parentPage": "/mcp-security/",
      "justification": "High-intent deployment page",
      "priority": "Rank 47",
      "publicationStatus": "planned"
    },
    {
      "rank": 48,
      "title": "MCP Registry Security",
      "url": "/mcp-registry-security/",
      "searchIntent": "Understand namespace verification and registry advisories",
      "packageSourceIds": [
        "SEC062",
        "SEC063",
        "SEC064",
        "SEC065",
        "SEC066",
        "SEC095"
      ],
      "sourceIds": [
        "S216",
        "S217",
        "S218",
        "S219",
        "S220",
        "S067"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Official infrastructure and supply-chain topic",
      "priority": "Rank 48",
      "publicationStatus": "planned"
    },
    {
      "rank": 49,
      "title": "How to Vet an MCP Server",
      "url": "/vet-mcp-server/",
      "searchIntent": "Practical approval and provenance workflow",
      "packageSourceIds": [
        "SEC016",
        "SEC090",
        "SEC095"
      ],
      "sourceIds": [
        "S134",
        "S244",
        "S067"
      ],
      "parentPage": "/mcp-security/",
      "justification": "User decision intent",
      "priority": "Rank 49",
      "publicationStatus": "planned"
    },
    {
      "rank": 50,
      "title": "How to Secure an MCP Server",
      "url": "/secure-mcp-server/",
      "searchIntent": "Implementation-focused control guide",
      "packageSourceIds": [
        "SEC015",
        "SEC016",
        "SEC025"
      ],
      "sourceIds": [
        "S133",
        "S134",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Strong how-to intent",
      "priority": "Rank 50",
      "publicationStatus": "planned"
    },
    {
      "rank": 51,
      "title": "MCP Security Testing",
      "url": "/mcp-security-testing/",
      "searchIntent": "Test protocol, auth, server and semantic layers",
      "packageSourceIds": [
        "SEC038",
        "SEC039"
      ],
      "sourceIds": [
        "S197",
        "S198"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Developer/security practitioner intent",
      "priority": "Rank 51",
      "publicationStatus": "planned"
    },
    {
      "rank": 52,
      "title": "MCP Threat Modeling",
      "url": "/mcp-threat-modeling/",
      "searchIntent": "Use layered STRIDE/dataflow model",
      "packageSourceIds": [
        "SEC039",
        "SEC040"
      ],
      "sourceIds": [
        "S198",
        "S199"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Research and enterprise intent",
      "priority": "Rank 52",
      "publicationStatus": "planned"
    },
    {
      "rank": 53,
      "title": "MCP Security Scanner Comparison",
      "url": "/mcp-security-scanners/",
      "searchIntent": "Compare scanner scope and evidence",
      "packageSourceIds": [
        "SEC038",
        "SEC044"
      ],
      "sourceIds": [
        "S197",
        "S203"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Commercial and developer intent; must avoid rankings without tests",
      "priority": "Rank 53",
      "publicationStatus": "planned"
    },
    {
      "rank": 54,
      "title": "OWASP MCP Top 10 Explained",
      "url": "/owasp-mcp-top-10/",
      "searchIntent": "Explain beta categories and limits",
      "packageSourceIds": [
        "SEC027"
      ],
      "sourceIds": [
        "S190"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Established framework query",
      "priority": "Rank 54",
      "publicationStatus": "planned"
    },
    {
      "rank": 55,
      "title": "NSA MCP Security Guidance Explained",
      "url": "/nsa-mcp-security-guidance/",
      "searchIntent": "Interpret government guidance against current spec",
      "packageSourceIds": [
        "SEC025",
        "SEC026",
        "SEC014"
      ],
      "sourceIds": [
        "S188",
        "S189",
        "S055"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Authority/backlink opportunity",
      "priority": "Rank 55",
      "publicationStatus": "planned"
    },
    {
      "rank": 56,
      "title": "MCP Security by Protocol Version",
      "url": "/mcp-security-by-version/",
      "searchIntent": "Version-freeze security requirements",
      "packageSourceIds": [
        "SEC002",
        "SEC007",
        "SEC010",
        "SEC012",
        "SEC014"
      ],
      "sourceIds": [
        "S024",
        "S036",
        "S043",
        "S049",
        "S055"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Unique historical information gain",
      "priority": "Rank 56",
      "publicationStatus": "planned"
    },
    {
      "rank": 57,
      "title": "MCP 2024 Security Model",
      "url": "/mcp-2024-security/",
      "searchIntent": "Launch-era local trust assumptions",
      "packageSourceIds": [
        "SEC002",
        "SEC003",
        "SEC004"
      ],
      "sourceIds": [
        "S024",
        "S027",
        "S028"
      ],
      "parentPage": "/mcp-security-by-version/",
      "justification": "Historical version page",
      "priority": "Rank 57",
      "publicationStatus": "planned"
    },
    {
      "rank": 58,
      "title": "MCP 2025 Security Model",
      "url": "/mcp-2025-security/",
      "searchIntent": "Remote expansion and OAuth evolution",
      "packageSourceIds": [
        "SEC007",
        "SEC010",
        "SEC012"
      ],
      "sourceIds": [
        "S036",
        "S043",
        "S049"
      ],
      "parentPage": "/mcp-security-by-version/",
      "justification": "Historical version page",
      "priority": "Rank 58",
      "publicationStatus": "planned"
    },
    {
      "rank": 59,
      "title": "MCP 2026 Security Model",
      "url": "/mcp-2026-security/",
      "searchIntent": "Stateless, header, cache, Apps and Tasks risks",
      "packageSourceIds": [
        "SEC014",
        "SEC015",
        "SEC020",
        "SEC021"
      ],
      "sourceIds": [
        "S055",
        "S133",
        "S136",
        "S137"
      ],
      "parentPage": "/mcp-security-by-version/",
      "justification": "Current version page",
      "priority": "Rank 59",
      "publicationStatus": "planned"
    },
    {
      "rank": 60,
      "title": "Is MCP Secure?",
      "url": "/is-mcp-secure/",
      "searchIntent": "Direct answer for broad users",
      "packageSourceIds": [
        "SEC016",
        "SEC025"
      ],
      "sourceIds": [
        "S134",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "High-volume direct question; must not duplicate pillar",
      "priority": "Rank 60",
      "publicationStatus": "reconciled-to-existing-canonical",
      "canonicalTarget": "/mcp-security/",
      "cannibalizationGuard": "The broad security or FAQ intent is already answered visibly by the /mcp-security/ cornerstone."
    },
    {
      "rank": 61,
      "title": "Can MCP Servers Access Your Computer?",
      "url": "/can-mcp-servers-access-your-computer/",
      "searchIntent": "Explain OS authority and permissions",
      "packageSourceIds": [
        "SEC003",
        "SEC016"
      ],
      "sourceIds": [
        "S027",
        "S134"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Consumer safety query",
      "priority": "Rank 61",
      "publicationStatus": "planned"
    },
    {
      "rank": 62,
      "title": "Can MCP Servers Steal API Keys?",
      "url": "/can-mcp-servers-steal-api-keys/",
      "searchIntent": "Explain environment and package risks",
      "packageSourceIds": [
        "SEC084",
        "SEC090"
      ],
      "sourceIds": [
        "S238",
        "S244"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Direct risk query",
      "priority": "Rank 62",
      "publicationStatus": "planned"
    },
    {
      "rank": 63,
      "title": "MCP Server Permissions",
      "url": "/mcp-server-permissions/",
      "searchIntent": "Map host, server and upstream permissions",
      "packageSourceIds": [
        "SEC016",
        "SEC025"
      ],
      "sourceIds": [
        "S134",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Beginner and enterprise intent",
      "priority": "Rank 63",
      "publicationStatus": "planned"
    },
    {
      "rank": 64,
      "title": "MCP Zero Trust Architecture",
      "url": "/mcp-zero-trust/",
      "searchIntent": "Apply existing identity and network controls without claiming MCP implements zero trust",
      "packageSourceIds": [
        "SEC015",
        "SEC025"
      ],
      "sourceIds": [
        "S133",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Enterprise architecture intent",
      "priority": "Rank 64",
      "publicationStatus": "planned"
    },
    {
      "rank": 65,
      "title": "MCP Data Loss Prevention",
      "url": "/mcp-data-loss-prevention/",
      "searchIntent": "Control tool arguments, outputs and cross-server flows",
      "packageSourceIds": [
        "SEC035",
        "SEC025"
      ],
      "sourceIds": [
        "S108",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Enterprise security intent",
      "priority": "Rank 65",
      "publicationStatus": "planned"
    },
    {
      "rank": 66,
      "title": "MCP Server Allowlisting",
      "url": "/mcp-server-allowlisting/",
      "searchIntent": "Approved catalogs and config policy",
      "packageSourceIds": [
        "SEC016",
        "SEC027"
      ],
      "sourceIds": [
        "S134",
        "S190"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Enterprise governance intent",
      "priority": "Rank 66",
      "publicationStatus": "planned"
    },
    {
      "rank": 67,
      "title": "MCP Incident Response",
      "url": "/mcp-incident-response/",
      "searchIntent": "Inventory, revoke, isolate and investigate",
      "packageSourceIds": [
        "SEC025",
        "SEC027"
      ],
      "sourceIds": [
        "S188",
        "S190"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Operational evergreen page",
      "priority": "Rank 67",
      "publicationStatus": "planned"
    },
    {
      "rank": 68,
      "title": "MCP Vulnerability Disclosure",
      "url": "/mcp-vulnerability-disclosure/",
      "searchIntent": "Report protocol, SDK and server flaws correctly",
      "packageSourceIds": [
        "SEC096"
      ],
      "sourceIds": [
        "S248"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Contributor and vendor intent",
      "priority": "Rank 68",
      "publicationStatus": "planned"
    },
    {
      "rank": 69,
      "title": "MCP Security Update Policy",
      "url": "/mcp-security-update-policy/",
      "searchIntent": "Maintain advisories and protocol checks",
      "packageSourceIds": [
        "SEC014",
        "SEC096"
      ],
      "sourceIds": [
        "S055",
        "S248"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Editorial transparency page",
      "priority": "Rank 69",
      "publicationStatus": "planned"
    },
    {
      "rank": 70,
      "title": "MCP Security Architecture Diagram",
      "url": "/mcp-security-architecture/",
      "searchIntent": "Visual trust boundary reference",
      "packageSourceIds": [
        "SEC014",
        "SEC015",
        "SEC016"
      ],
      "sourceIds": [
        "S055",
        "S133",
        "S134"
      ],
      "parentPage": "/mcp-security/",
      "justification": "Image and snippet potential",
      "priority": "Rank 70",
      "publicationStatus": "planned"
    },
    {
      "rank": 71,
      "title": "MCP Security FAQ",
      "url": "/mcp-security-faq/",
      "searchIntent": "Concise answers with links to pillar",
      "packageSourceIds": [
        "SEC015",
        "SEC016",
        "SEC025"
      ],
      "sourceIds": [
        "S133",
        "S134",
        "S188"
      ],
      "parentPage": "/mcp-security/",
      "justification": "FAQ query aggregation; avoid duplicating full article",
      "priority": "Rank 71",
      "publicationStatus": "reconciled-to-existing-canonical",
      "canonicalTarget": "/mcp-security/",
      "cannibalizationGuard": "The broad security or FAQ intent is already answered visibly by the /mcp-security/ cornerstone."
    }
  ]
}