{
  "title": "MCP Security Responsibility by Role",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-26",
  "protocolRevision": "2026-07-28",
  "count": 15,
  "records": [
    {
      "recordId": "R5-SEC01",
      "securityDecision": "Which servers may be configured",
      "host": "Allowlist, admin policy, project trust",
      "client": "Loads only approved configuration",
      "server": "No authority over host catalog",
      "underlyingSystem": "N/A",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC02",
      "securityDecision": "Which tools reach the model",
      "host": "Filters, names, groups and limits schemas",
      "client": "Returns discovered definitions",
      "server": "Publishes definitions and annotations",
      "underlyingSystem": "N/A",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC03",
      "securityDecision": "Whether a tool call needs confirmation",
      "host": "Primary UI and policy owner",
      "client": "Carries approved invocation",
      "server": "May require its own approval or authorization",
      "underlyingSystem": "May have native approval workflow",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC04",
      "securityDecision": "Whether arguments are semantically valid",
      "host": "Can perform prechecks and show user",
      "client": "Schema serialization/validation",
      "server": "Primary semantic validation",
      "underlyingSystem": "Must enforce object and business rules",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC05",
      "securityDecision": "Whether user can access target object",
      "host": "May know workspace/user policy",
      "client": "Carries identity/token",
      "server": "Must enforce or preserve authorization",
      "underlyingSystem": "Final native authorization should remain active",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC06",
      "securityDecision": "Server identity trust",
      "host": "Shows publisher/endpoint and policy",
      "client": "Validates TLS/discovery metadata as implemented",
      "server": "Provides identity metadata but self-report is not proof",
      "underlyingSystem": "May bind application registration",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC07",
      "securityDecision": "Local package execution",
      "host": "Prompts, project trust, sandbox policy",
      "client": "Launches exact command/package",
      "server": "Runs with inherited authority",
      "underlyingSystem": "OS permissions constrain effects",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC08",
      "securityDecision": "OAuth consent",
      "host": "Presents account/scopes and user choice",
      "client": "Runs authorization flow",
      "server": "Publishes protected-resource metadata and validates tokens",
      "underlyingSystem": "Authorization server issues scoped credentials",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC09",
      "securityDecision": "Token audience and issuer",
      "host": "Chooses trusted endpoint/account",
      "client": "Requests resource-bound token",
      "server": "Validates audience/issuer",
      "underlyingSystem": "Authorization server binds token",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC10",
      "securityDecision": "Conversation privacy",
      "host": "Keeps full conversation and decides what to send",
      "client": "Maintains server isolation",
      "server": "Must not assume access to omitted context",
      "underlyingSystem": "Receives only delegated request",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC11",
      "securityDecision": "Cross-server data flow",
      "host": "Only component positioned to combine servers",
      "client": "Should not bridge peer data implicitly",
      "server": "Cannot inspect peers by protocol",
      "underlyingSystem": "N/A",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC12",
      "securityDecision": "Result safety",
      "host": "Treats content as untrusted, renders/sanitizes",
      "client": "Preserves typed result accurately",
      "server": "Avoids hidden instructions, validates returned data",
      "underlyingSystem": "May return attacker-controlled content",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC13",
      "securityDecision": "State-handle authorization",
      "host": "Keeps handle in correct user/task context",
      "client": "Carries handle",
      "server": "Binds, authorizes, expires and prevents guessing",
      "underlyingSystem": "Stores state safely",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC14",
      "securityDecision": "Tenant isolation",
      "host": "Separates users/workspaces",
      "client": "Sends correct auth context",
      "server": "Primary remote tenant enforcement",
      "underlyingSystem": "Uses tenant-aware access controls",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    },
    {
      "recordId": "R5-SEC15",
      "securityDecision": "Audit trail",
      "host": "User intent, model call and confirmation",
      "client": "Protocol request/response trace",
      "server": "Execution, authorization and backend change",
      "underlyingSystem": "Native change/audit log",
      "packageSourceIds": [
        "S001",
        "S009"
      ],
      "sourceIds": [
        "S121",
        "S123"
      ]
    }
  ]
}