{
  "title": "MCP Security — Visual Brief Manifest",
  "schemaVersion": "1.0",
  "researchFreeze": "2026-08-25",
  "protocolRevision": "2026-07-28",
  "provenanceNote": "Normalized from the 15 supplied Markdown briefs; each is implemented as an SVG or a named native semantic representation in the article.",
  "count": 15,
  "records": [
    {
      "id": "R4-VIS01",
      "packageVisualId": "VIS01",
      "title": "MCP Security Trust-Boundary Map",
      "purpose": "Show user, host, client, transport, server, authorization server and underlying system with trust boundaries.",
      "sourceBasis": "Current 2026-07-28 architecture plus notes for local stdio.",
      "protocolVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC014",
        "SEC015",
        "SEC016"
      ],
      "sourceIds": [
        "S055",
        "S133",
        "S134"
      ],
      "uncertaintyNotes": "Do not draw the removed initialize handshake.",
      "caption": "A layered diagram showing every identity and data boundary in an MCP deployment.",
      "alt": "A layered diagram showing every identity and data boundary in an MCP deployment.",
      "representation": "svg",
      "asset": "mcp-security-trust-boundaries.svg",
      "status": "new canonical visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS02",
      "packageVisualId": "VIS02",
      "title": "MCP Security Layers",
      "purpose": "Prevent every incident being mislabeled as a protocol flaw.",
      "sourceBasis": "Nine-layer responsibility matrix.",
      "protocolVersion": "All",
      "packageSourceIds": [
        "SEC016",
        "SEC025"
      ],
      "sourceIds": [
        "S134",
        "S188"
      ],
      "uncertaintyNotes": "Use distinct layers, not a single shield around MCP.",
      "caption": "MCP security layers from protocol through underlying systems.",
      "alt": "MCP security layers from protocol through underlying systems.",
      "representation": "svg",
      "asset": "mcp-security-layers.svg",
      "status": "new canonical visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS03",
      "packageVisualId": "VIS03",
      "title": "Security Evolution by Specification",
      "purpose": "Show changing assumptions from local-first to remote authenticated and stateless infrastructure.",
      "sourceBasis": "security_evolution matrix.",
      "protocolVersion": "2024-11-05 through 2026-07-28",
      "packageSourceIds": [
        "SEC002",
        "SEC007",
        "SEC010",
        "SEC012",
        "SEC014"
      ],
      "sourceIds": [
        "S024",
        "S036",
        "S043",
        "S049",
        "S055"
      ],
      "uncertaintyNotes": "Authorization and sessions must be version-frozen.",
      "caption": "Timeline of MCP security architecture by protocol revision.",
      "alt": "Timeline of MCP security architecture by protocol revision.",
      "representation": "svg",
      "asset": "mcp-security-evolution.svg",
      "status": "new canonical visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS04",
      "packageVisualId": "VIS04",
      "title": "Local MCP Attack Surface",
      "purpose": "Show package, project config, process, environment, filesystem and local network risks.",
      "sourceBasis": "Local threat register.",
      "protocolVersion": "All; current stdio guidance",
      "packageSourceIds": [
        "SEC016",
        "SEC050",
        "SEC079",
        "SEC084"
      ],
      "sourceIds": [
        "S134",
        "S111",
        "S233",
        "S238"
      ],
      "uncertaintyNotes": "stdio is not itself labeled vulnerable.",
      "caption": "Attack paths around a locally launched MCP server.",
      "alt": "Attack paths around a locally launched MCP server.",
      "representation": "svg",
      "asset": "mcp-local-attack-surface.svg",
      "status": "new canonical visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS05",
      "packageVisualId": "VIS05",
      "title": "Remote MCP Attack Surface",
      "purpose": "Show DNS, TLS, OAuth, tokens, tenants, routing, caches and upstream APIs.",
      "sourceBasis": "Remote threat register.",
      "protocolVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC015",
        "SEC016",
        "SEC037"
      ],
      "sourceIds": [
        "S133",
        "S134",
        "S196"
      ],
      "uncertaintyNotes": "Separate authentication from authorization.",
      "caption": "Attack paths around a remote multi-tenant MCP service.",
      "alt": "Attack paths around a remote multi-tenant MCP service.",
      "representation": "svg",
      "asset": "mcp-remote-attack-surface.svg",
      "status": "new canonical visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS06",
      "packageVisualId": "VIS06",
      "title": "OAuth Authorization Flow with Threat Points",
      "purpose": "Explain protected-resource metadata, AS discovery, client identity, PKCE, resource indicator and token validation.",
      "sourceBasis": "Current authorization spec.",
      "protocolVersion": "2026-07-28",
      "packageSourceIds": [
        "SEC015",
        "SEC028",
        "SEC029",
        "SEC030",
        "SEC031",
        "SEC032"
      ],
      "sourceIds": [
        "S133",
        "S191",
        "S006",
        "S005",
        "S192",
        "S004"
      ],
      "uncertaintyNotes": "Do not call OAuth an authentication protocol without qualification.",
      "caption": "MCP OAuth flow annotated with validation and attack points.",
      "alt": "MCP OAuth flow annotated with validation and attack points.",
      "representation": "svg",
      "asset": "mcp-oauth-security-flow.svg",
      "status": "new canonical visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS07",
      "packageVisualId": "VIS07",
      "title": "Tool Poisoning Sequence",
      "purpose": "Show malicious metadata entering model context and causing unauthorized data flow.",
      "sourceBasis": "Invariant disclosure and threat-model research.",
      "protocolVersion": "2025–present",
      "packageSourceIds": [
        "SEC035",
        "SEC039"
      ],
      "sourceIds": [
        "S108",
        "S198"
      ],
      "uncertaintyNotes": "Label as model/host/server-metadata interaction, not generic JSON-RPC flaw.",
      "caption": "How poisoned tool metadata can redirect an agent.",
      "alt": "How poisoned tool metadata can redirect an agent.",
      "representation": "svg",
      "asset": "mcp-tool-poisoning.svg",
      "status": "new canonical visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS08",
      "packageVisualId": "VIS08",
      "title": "Tool Shadowing and Cross-Server Dataflow",
      "purpose": "Show one malicious server influencing a trusted server.",
      "sourceBasis": "Invariant shadowing experiment.",
      "protocolVersion": "2025–present",
      "packageSourceIds": [
        "SEC035"
      ],
      "sourceIds": [
        "S108"
      ],
      "uncertaintyNotes": "Clearly distinguish metadata influence from direct server-to-server protocol calls.",
      "caption": "A malicious server changes how the model invokes a trusted tool.",
      "alt": "A malicious server changes how the model invokes a trusted tool.",
      "representation": "svg",
      "asset": "mcp-tool-shadowing.svg",
      "status": "new canonical visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS09",
      "packageVisualId": "VIS09",
      "title": "Supply-Chain Compromise Chain",
      "purpose": "From directory listing to package install, dependency, update and local execution.",
      "sourceBasis": "Supply-chain register and malicious package case.",
      "protocolVersion": "2025–present",
      "packageSourceIds": [
        "SEC090",
        "SEC094",
        "SEC095"
      ],
      "sourceIds": [
        "S244",
        "S066",
        "S067"
      ],
      "uncertaintyNotes": "Registry listing is not code certification.",
      "caption": "How a malicious or compromised MCP package reaches a workstation.",
      "alt": "How a malicious or compromised MCP package reaches a workstation.",
      "representation": "svg",
      "asset": "mcp-supply-chain.svg",
      "status": "new canonical visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS10",
      "packageVisualId": "VIS10",
      "title": "Protocol Flaw vs Implementation Flaw",
      "purpose": "Classify representative advisories by layer.",
      "sourceBasis": "Vulnerability timeline.",
      "protocolVersion": "2025–2026",
      "packageSourceIds": [
        "SEC046",
        "SEC050",
        "SEC060",
        "SEC071"
      ],
      "sourceIds": [
        "S109",
        "S111",
        "S147",
        "S225"
      ],
      "uncertaintyNotes": "Do not imply all servers share one product vulnerability.",
      "caption": "Representative MCP advisories classified by affected component.",
      "alt": "Representative MCP advisories classified by affected component.",
      "representation": "html-table",
      "status": "native advisory classification and downloadable timeline",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS11",
      "packageVisualId": "VIS11",
      "title": "Stateful MCP vs Stateless MCP Security",
      "purpose": "Compare session IDs with explicit handles, request metadata and cache scopes.",
      "sourceBasis": "2025-11-25 and 2026-07-28 specs.",
      "protocolVersion": "Pre/post 2026-07-28",
      "packageSourceIds": [
        "SEC012",
        "SEC014",
        "SEC016"
      ],
      "sourceIds": [
        "S049",
        "S055",
        "S134"
      ],
      "uncertaintyNotes": "Stateless protocol does not mean no state.",
      "caption": "How state-related risks changed when protocol sessions were removed.",
      "alt": "How state-related risks changed when protocol sessions were removed.",
      "representation": "svg",
      "asset": "old-vs-current.svg",
      "status": "reused canonical state-transition visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS12",
      "packageVisualId": "VIS12",
      "title": "MCP Apps Security Model",
      "purpose": "Show sandboxed iframe, host bridge, tool requests, CSP and network boundary.",
      "sourceBasis": "Apps extension.",
      "protocolVersion": "Current extension",
      "packageSourceIds": [
        "SEC020"
      ],
      "sourceIds": [
        "S136"
      ],
      "uncertaintyNotes": "Mark host-specific support as live-check.",
      "caption": "Security boundaries for a server-provided MCP App UI.",
      "alt": "Security boundaries for a server-provided MCP App UI.",
      "representation": "svg",
      "asset": "apps-vs-tasks.svg",
      "status": "reused canonical extension-boundary visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS13",
      "packageVisualId": "VIS13",
      "title": "Tasks Authorization Lifecycle",
      "purpose": "Show task creation, polling/input, privilege change, cancellation and result access.",
      "sourceBasis": "Tasks extension and security guidance.",
      "protocolVersion": "Current extension",
      "packageSourceIds": [
        "SEC021",
        "SEC016"
      ],
      "sourceIds": [
        "S137",
        "S134"
      ],
      "uncertaintyNotes": "Do not equate task handle with automatic authorization.",
      "caption": "Authorization checks across a long-running MCP Task.",
      "alt": "Authorization checks across a long-running MCP Task.",
      "representation": "article-section",
      "status": "native Tasks authorization lifecycle section",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS14",
      "packageVisualId": "VIS14",
      "title": "Enterprise MCP Gateway Architecture",
      "purpose": "Show approved catalog, identity, policy, DLP, audit, egress and server zones.",
      "sourceBasis": "Reference architecture synthesis.",
      "protocolVersion": "Current",
      "packageSourceIds": [
        "SEC016",
        "SEC025",
        "SEC022"
      ],
      "sourceIds": [
        "S134",
        "S188",
        "S064"
      ],
      "uncertaintyNotes": "Gateway features are platform-specific, not core MCP requirements.",
      "caption": "A defense-in-depth enterprise MCP deployment.",
      "alt": "A defense-in-depth enterprise MCP deployment.",
      "representation": "svg",
      "asset": "mcp-enterprise-gateway.svg",
      "status": "new canonical visual",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    },
    {
      "id": "R4-VIS15",
      "packageVisualId": "VIS15",
      "title": "Secure MCP Deployment Checklist",
      "purpose": "One-page operational control map for local and remote deployments.",
      "sourceBasis": "Threat-mitigation matrix.",
      "protocolVersion": "Current",
      "packageSourceIds": [
        "SEC015",
        "SEC016",
        "SEC025"
      ],
      "sourceIds": [
        "S133",
        "S134",
        "S188"
      ],
      "uncertaintyNotes": "Separate must/should from product-specific recommendations.",
      "caption": "Checklist of controls for approving and operating MCP servers.",
      "alt": "Checklist of controls for approving and operating MCP servers.",
      "representation": "article-checklist",
      "status": "native secure-deployment checklist",
      "provenance": "Normalized from the supplied MCP_SECURITY_VISUAL_SPECS.md brief."
    }
  ]
}