Public evidence library
This is the research spine of MCP Blog: 285 canonical records spanning the protocol’s technical roots, public history, specifications, ecosystem, governance, security, and current host documentation.
Search the corpus
285 sources shown
Durable — historical or normative source unlikely to change
Live check — current-state claim must be reverified before reuse
Periodic — stable enough to cite, but worth scheduled review
JSON-RPC Working Group
Supports: Defines requests, responses, notifications, errors, and batching used by MCP. Requests, responses, notifications, errors and transport independence. Request, response, notification, error and transport-agnostic RPC semantics Request, response, notification and error object semantics used by MCP.
Microsoft
Supports: Primary architectural background for editor-client/language-server reuse and JSON-RPC capability negotiation.
IETF
Supports: Background for delegated authorization terminology.
IETF
Supports: PKCE requirements used in MCP authorization. PKCE security properties for public clients
IETF
Supports: Resource Indicators added to MCP authorization hardening. Audience-bound resource parameter
IETF
Supports: Protected-resource metadata used by MCP resource servers. Protected-resource metadata used by MCP authorization
IETF OAuth WG
Supports: Status and evolving basis of MCP authorization framework.
OpenID Foundation
Supports: Discovery mechanism supported in MCP 2025-11-25.
OpenAI
Supports: Pre-MCP vendor plugin architecture using manifests, APIs, and OAuth. Earlier vendor-specific plugin model using manifests, OpenAPI and OAuth.
OpenAI
Supports: Pre-MCP model function-calling history. Pre-MCP function-calling history and structured model action selection. Public OpenAI function-calling introduction, JSON arguments and early security warning
Anthropic
Supports: Distinguishes vendor tool-use APIs from MCP interoperability. Client versus server tools and structured tool_use behavior
Model Context Protocol
Supports: Repository creation predates the public announcement.
Model Context Protocol
Supports: Earliest public commit; states LSP inspiration, host/client/server/session terminology, resources, prompts, tools, sampling, stdio and SSE. Earliest public repository evidence and explicit LSP inspiration.
Model Context Protocol
Supports: Earliest public TypeScript SDK evidence.
Model Context Protocol
Supports: Shows capability declarations still being refined before launch.
Model Context Protocol
Supports: Repository creation and evolution of reference servers.
Model Context Protocol
Supports: First public reference-server monorepo commit. Earliest verified public reference server set.
Model Context Protocol
Supports: Confirms initial public directories including everything, Google Drive, Git, Postgres, and Puppeteer.
Anthropic
Supports: Public launch, creators, SDKs, Claude Desktop support, example integrations, and stated integration problem. Public announcement, integration-fragmentation rationale, SDKs, Claude Desktop and example servers. MCP public announcement, integration-fragmentation rationale, initial SDK and host context Public launch, initial local-first integration rationale, initial SDK and host context
Zed Industries
Supports: Launch-day non-Anthropic host integration and explicit LSP comparison. Zed launch-day MCP integration and collaboration with Anthropic.
Model Context Protocol
Supports: Current creator credit to David Soria Parra and Justin Spahr-Summers. Official creator credit for David Soria Parra and Justin Spahr-Summers.
Model Context Protocol
Supports: Authoritative launch-era specification overview. Launch-era stateful architecture, initialization, stdio, HTTP+SSE and original capabilities. Initial released protocol overview and date-based revision Launch-era architecture, lifecycle, capabilities and trust guidance
Model Context Protocol
Supports: Launch-era host/client/server architecture. Launch-era host, client, server, JSON-RPC and stateful-session architecture
Model Context Protocol
Supports: Initialize/initialized handshake, version and capability negotiation. Launch-era initialize/initialized lifecycle and capability negotiation.
Model Context Protocol
Supports: stdio and HTTP+SSE semantics. Original stdio and HTTP+SSE transport behavior Original stdio and HTTP+SSE transport semantics
Model Context Protocol
Supports: Launch-era tool listing and invocation. Launch-era tool definition and model-controlled interaction guidance Launch-era tool discovery, invocation and human-control guidance
Model Context Protocol
Supports: URI-addressed resources, templates, and subscriptions. Launch-era resource semantics Launch-era resources, subscriptions and data exposure semantics
Model Context Protocol
Supports: Server-exposed prompt templates and user-controlled workflows. Launch-era prompt-template semantics
Model Context Protocol
Supports: Server requests model sampling through client/host. Launch-era server-to-client sampling and user-control expectations
Model Context Protocol
Supports: Argument-completion utility present at launch.
Model Context Protocol
Supports: OAuth framework, Streamable HTTP, batching, tool annotations, audio, progress, completions capability. OAuth-based authorization, Streamable HTTP, JSON-RPC batching, tool annotations, audio, progress text and completions capability entered the released specification. OAuth framework, Streamable HTTP, batching, annotations, audio and completions Initial authorization framework, Streamable HTTP, annotations and batching Streamable HTTP, OAuth framework, batching and tool annotations.
Model Context Protocol
Supports: First protocol authorization framework. Initial OAuth-oriented remote authorization framework First protocol authorization framework for HTTP deployments
Model Context Protocol
Supports: Original Streamable HTTP, stateful session, optional SSE, backwards compatibility. Original Streamable HTTP semantics, including POST/GET, optional SSE, resumability and optional Mcp-Session-Id session management.
Model Context Protocol
Supports: Design history for replacing HTTP+SSE.
Model Context Protocol
Supports: Authorization proposal and merge history.
Model Context Protocol
Supports: Origin of read-only, destructive, idempotent, and open-world hints.
Model Context Protocol
Supports: Batching removal, structured output, resource-server classification, Resource Indicators, elicitation, resource links. JSON-RPC batching was removed; structured tool output, resource links, elicitation and authorization hardening were added. Batching removal, structured output, elicitation and authorization hardening Resource-server classification, protected-resource metadata, Resource Indicators and structured output Removal of batching, structured tool output, elicitation and authorization hardening.
Model Context Protocol
Supports: OAuth resource-server model, protected resource metadata, PKCE, Resource Indicators. Resource Indicators, token audience validation and resource-server model Audience restrictions, protected resource metadata and token validation
Model Context Protocol
Supports: Structured tool output and output schema. Structured tool output and outputSchema semantics
Model Context Protocol
Supports: Server-initiated user information request capability.
Model Context Protocol
Supports: Token passthrough, confused deputy, least privilege, and proxy risks.
Model Context Protocol
Supports: OIDC discovery, icons, incremental scopes, URL elicitation, sampling tools, client metadata documents, experimental tasks, governance. OIDC discovery, icon metadata, incremental scope consent, richer elicitation, CIMD, tool use in sampling and experimental Tasks entered the released specification. One-year revision changes including experimental Tasks OIDC discovery, CIMD, incremental consent, URL elicitation and experimental Tasks OIDC discovery, CIMD, expanded elicitation, experimental Tasks and governance changes.
Model Context Protocol
Supports: Sensitive/out-of-band user interactions.
Model Context Protocol
Supports: RC date and 14-day validation process.
Model Context Protocol
Supports: RC chronology and rationale for stateless core, extensions, tasks, apps, and deprecation. RC date, validation window, motivations and distinction between RC and GA. RC chronology and technical motivation for stateless architecture Infrastructure motivation for statelessness, routing and caching Release-candidate chronology and before/after architecture rationale.
Model Context Protocol
Supports: Current authoritative specification at verification date. Current authoritative protocol overview, roles, JSON-RPC basis, primitives, security principles.
Model Context Protocol
Supports: Stateless core, discovery, MRTR, subscriptions/listen, routing headers, caching, tasks extension, deprecations. Removal of handshake and sessions; discovery, subscriptions, routing, caching, extensions and deprecations. Canonical list of 2026 additions, removals, deprecations and compatibility effects Stateless core, removal of sessions and initialization, routing headers, cache scope, auth hardening, MRTR and deprecations Removal of initialize, initialized, protocol sessions and Mcp-Session-Id; addition of server/discover, MRTR, routing headers and cacheable results.
Model Context Protocol
Supports: Modern/legacy/dual-era compatibility and per-request versioning. Current version declaration and compatibility behavior Per-request version declaration, modern versus legacy eras, discovery and dual-era compatibility.
Model Context Protocol
Supports: Current transport bindings and no server-initiated JSON-RPC requests in modern core. Current stdio and Streamable HTTP semantics Current sessionless HTTP transport and request header rules Transport is separate from protocol semantics; current stdio and Streamable HTTP transports.
Model Context Protocol
Supports: GA announcement, SDK support, architecture rationale, download claims. GA announcement and maintainer explanation of the stateless revision. GA release, stateless core, MRTR, routing, caching, auth and extensions Maintainer explanation of the current release GA announcement and maintainers’ explanation of stateless architecture, discovery, MRTR, caching and extensions.
Model Context Protocol
Supports: First official extension; sandboxed server-provided UI. Launch of the first official MCP extension and historical context. MCP Apps origin and server-provided UI concept
Model Context Protocol
Supports: Tasks moved from experimental core to official extension. Migration of Tasks from experimental core into an official extension.
Model Context Protocol
Supports: Removal of handshake/sessions and per-request metadata model. Motivation and proposal history for removing initialization state.
Model Context Protocol
Supports: InputRequiredResult retry pattern.
Model Context Protocol
Supports: Stable enterprise authorization extension.
Model Context Protocol
Supports: Post-2026-07-28 priorities; proposals, not shipped features. Current roadmap priorities; proposals are not shipped features. Agent identity, enterprise-ready security and HTTP hardening priorities Current roadmap and retrospective confirmation of session and handshake removal.
Model Context Protocol
Supports: Active, Deprecated, Removed states and minimum deprecation window.
Model Context Protocol
Supports: Official registry preview launch and origin history. Registry launch date, preview status and collaborative origin. Registry launch, namespace verification and metadata role
Model Context Protocol
Supports: Current preview status, metadata role, namespaces, package-registry relationship, scanning limits. Official registry scope, metadata role, namespace verification and security-scanning limits. Registry metadata role and limits; code/package scanning delegated elsewhere
Model Context Protocol
Supports: SEP process and maintainer roles. Formal governance roles and SEP process.
Model Context Protocol
Supports: Donation to AAIF, technical autonomy, project-reported adoption statistics. MCP's Linux Foundation/AAIF organizational home and retained technical governance.
Model Context Protocol
Supports: Current lead/core maintainer structure and LF project status. Current maintainer structure and individual rather than corporate membership.
Model Context Protocol
Supports: MIT-to-Apache-2.0 transition and CC BY 4.0 documentation license.
Model Context Protocol
Supports: Tier 1–3 requirements and conformance-based governance. Meaning of SDK tiers and maintenance/conformance expectations.
Model Context Protocol
Supports: Contributor progression and governance transparency.
Model Context Protocol
Supports: Official launch SDK; current status live-check.
Model Context Protocol
Supports: Official launch SDK; current status live-check.
Model Context Protocol
Supports: Ruby 1.0 and Tier 2 milestone.
Model Context Protocol
Supports: PHP official GA announcement and initial server-only scope.
Microsoft / Visual Studio Code
Supports: Official VS Code MCP host/client support and LSP influence statement. Initial official VS Code MCP host support.
Microsoft / Visual Studio Code
Supports: Expansion from tools toward richer capabilities and installation UX. VS Code host behavior, tool picker and server integration.
Evidence note: First-party product documentation rechecked and normalized on 2026-08-25; the package URL remains in the package source map.
OpenAI
Supports: First unequivocal official remote MCP support in OpenAI API product. Official remote MCP support in the Responses API. First official OpenAI remote MCP support announcement
OpenAI
Supports: Current hosted, Streamable HTTP, SSE, and stdio MCP integration modes. MCP schema conversion, name prefixing, hosted/local transport, filtering, approvals and caching Hosted, Streamable HTTP, legacy SSE and stdio MCP client options; manager for multiple servers.
Amazon Web Services
Supports: Official open-source AWS server suite. Official AWS server suite adoption.
Google Cloud
Supports: Official Google Cloud server/platform support. Official Google Cloud MCP server/platform adoption.
Cloudflare
Supports: Remote hosting, OAuth provider, and Agents SDK support. Early official remote MCP hosting and OAuth infrastructure.
Cloudflare
Supports: Rapid transport adoption and dual-transport migration.
Cloudflare and vendors
Supports: Remote servers from multiple SaaS vendors; useful but partly promotional.
GitHub
Supports: Official remote server GA and authorization model.
Cursor
Supports: Current host support; first historical date remains separately qualified.
Notion
Supports: Official Notion server documentation; current state live-check.
LangChain
Supports: Framework adapter demonstrating MCP-to-native-tool mapping.
Microsoft
Supports: MCP adaptation into Semantic Kernel plugin abstraction.
Invariant Labs
Supports: Canonical disclosure of hidden tool-description attacks, rug pulls, and tool shadowing. Original tool-poisoning, rug-pull and cross-server-shadowing research. Original public disclosure of tool poisoning, shadowing and rug-pull patterns
Model Context Protocol
Supports: Inspector proxy exposure; implementation vulnerability, not core-protocol semantics. Representative host/developer-tool implementation vulnerability. Remote code execution due to unauthenticated Inspector proxy; patched/fixed status: 0.14.1
Evidence note: Layer: Host/developer tool. Verify current affected and fixed ranges before publication.
Model Context Protocol
Supports: Inspector implementation vulnerability with potential command-execution path. Representative Inspector UI vulnerability and patch boundary. Cross-site scripting in Inspector; patched/fixed status: 0.16.6
Evidence note: Layer: Host/developer tool. Verify current affected and fixed ranges before publication.
Model Context Protocol
Supports: HTTP SDK default-binding risk; stdio unaffected. Representative local HTTP SDK exposure and Origin/bind protection. DNS rebinding protection disabled by default for unauthenticated localhost HTTP servers; patched/fixed status: 1.24.0
Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication.
Model Context Protocol
Supports: Python HTTP SDK default-binding risk. Representative Python SDK DNS-rebinding vulnerability. DNS rebinding protection disabled by default for localhost HTTP servers; patched/fixed status: 1.23.0
Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication.
Model Context Protocol
Supports: SDK validation resource-exhaustion issue.
Model Context Protocol
Supports: SDK parsing/regular-expression vulnerability.
Academic researchers
Supports: Academic evaluation of malicious MCP tool metadata and behavior.
Academic researchers
Supports: Broader empirical MCP security analysis.
Supports: Agent-to-agent protocol launch and complementary positioning to MCP.
Linux Foundation
Supports: A2A governance transition.
IBM
Supports: ACP as an agent-to-agent protocol, not an MCP substitute at the same layer.
Model Context Protocol
Supports: Current host, client, server definitions; one client per server; stateless per-request model. Current host, client, and server definitions; one host manages multiple clients; each client relates to one server; stateless per-request architecture.
Model Context Protocol
Supports: Conceptual architecture, data and transport layers, local and remote servers.
Model Context Protocol
Supports: Tool discovery, schemas, invocation, result content, structured output, annotations and security rules. Current tool schemas, calls, results, annotations and state-handle guidance Current tool semantics, annotations, schemas, explicit handles and security considerations Tool discovery and invocation, host human-in-the-loop guidance, annotations, explicit handles and MRTR.
Model Context Protocol
Supports: URI-identified resources, list/read/templates and subscriptions behavior. Current resource primitive Server-exposed resources, URI identification, list/read behavior and subscriptions.
Model Context Protocol
Supports: Protocol-exposed prompt templates, arguments, list/get behavior and user control. Current prompt primitive Server-exposed prompt templates and host presentation.
Model Context Protocol
Supports: Server requests for user input, form and URL modes, restrictions on sensitive data. Current client-side elicitation through MRTR and host-controlled user interaction.
Model Context Protocol
Supports: Mandatory server/discover implementation and optional client invocation for versions and capabilities. Optional sessionless capability and version discovery server/discover semantics, supported versions and capabilities, optional client use, self-reported identity caveat.
Model Context Protocol
Supports: Cache hints and scope for complete list/read/discovery results.
Model Context Protocol
Supports: Current mechanism for additional client input without server-initiated JSON-RPC requests.
Model Context Protocol
Supports: JSON-RPC messages, current statelessness, explicit state identifiers and authorization applicability. Current JSON-RPC base messages and request metadata JSON-RPC basis, current message directions, requests, responses, notifications and result types.
Model Context Protocol
Supports: Current remote transport, one POST endpoint, optional request-scoped SSE, routing headers and security. Current single-endpoint HTTP behavior, removal of GET stream and protocol sessions, request-scoped SSE, Origin requirements.
Model Context Protocol
Supports: Local subprocess transport, newline-delimited JSON-RPC and stdout/stderr requirements. Local subprocess lifecycle, stdin/stdout framing, stderr logging, shutdown and restart behavior.
Model Context Protocol
Supports: Current HTTP authorization framework, OAuth resource-server roles, protected resource metadata and resource indicators. Current HTTP authorization roles, metadata, issuer validation, Resource Indicators, token handling and CIMD preference
Model Context Protocol
Supports: Confused deputy, token passthrough, SSRF, state handles, stdio proxy, redirect and issuer security. Layered security guidance, token handling and deployment risks Current official guidance on confused deputy, token passthrough, SSRF, local servers, state handles and OAuth URLs
Model Context Protocol
Supports: Roots, sampling, logging, DCR and HTTP+SSE deprecation status and migration paths.
Model Context Protocol
Supports: Interactive HTML interfaces, tool-linked UI resources, sandbox and host support variability. Server-provided interactive UI, sandboxing and host security boundary
Model Context Protocol
Supports: Durable asynchronous operations, task IDs, polling, input and cancellation semantics. Long-running task handles and lifecycle semantics
Microsoft
Supports: LSP client/server architecture and the M × N integration problem.
OpenAI
Supports: Current ChatGPT remote MCP limitations, local-server tunnel requirement and plan-dependent access. ChatGPT as a host with remote MCP connector support and MCP Apps; current availability and remote-only direct connection constraints.
Evidence note: First-party product documentation rechecked and normalized on 2026-08-25; the package URL remains in the package source map.
Microsoft / Visual Studio Code
Supports: Current local/remote installation, trust, sandboxing, prompts/resources/apps and enterprise policy support. VS Code host/client support for tools, resources, prompts and MCP Apps; local and remote servers, trust and policy.
Evidence note: First-party product documentation rechecked and normalized on 2026-08-25; the package URL remains in the package source map.
Microsoft / Visual Studio Code
Supports: Official authorization, prompts, resources and sampling adoption.
Microsoft / Visual Studio Code
Supports: Official MCP Apps host support.
Supports: Gemini CLI support for stdio, legacy SSE and Streamable HTTP, tools/resources/prompts, OAuth and confirmations. Gemini CLI local and remote MCP support and host permission flow.
Evidence note: First-party product documentation rechecked and normalized on 2026-08-25; the package URL remains in the package source map.
Anthropic
Supports: Claude custom remote MCP connector availability and trust cautions. Claude remote connector behavior and cloud-originated connections.
Anthropic
Supports: Remote connectors connect from Anthropic cloud and product terminology differs from protocol roles.
GitHub Advisory Database
Supports: Representative multi-client isolation implementation defect. Cross-client response data leakage when server/transport instances are reused; patched/fixed status: 1.26.0
Evidence note: Layer: SDK/multi-tenancy. Verify current affected and fixed ranges before publication.
Google Search Central
Supports: People-first, original, well-sourced content and no preferred word count. People-first, original, trustworthy content and authorship guidance People-first content, no preferred word count, authorship/process transparency and satisfying user intent.
Google Search Central
Supports: Accuracy, quality, relevance and transparent production context.
Google Search Central
Supports: Descriptive, concise and consistent title/H1 recommendations. Descriptive concise titles, distinctive H1 and avoidance of keyword stuffing.
Google Search Central
Supports: Structured data implementation and validation guidance.
Google Search Central
Supports: Article author, date, headline and image markup guidance. Article structured-data recommendations
Google Search Central
Supports: BreadcrumbList implementation and validation. BreadcrumbList markup guidance BreadcrumbList implementation and validation guidance.
Google Search Central
Supports: FAQ rich results are generally restricted to authoritative government and health sites.
Google Search Central
Supports: JSON-LD recommendation, relevance, accuracy and no guarantee of rich-result display. Accurate visible structured data and no rich-result guarantee
Model Context Protocol
Supports: Initialization, protocol-version agreement, capability negotiation, initialized notification and session-era lifecycle semantics. Initialization, version and capability negotiation in March 2025 Stateful initialization and negotiated capabilities during the first Streamable HTTP era.
A2A Project
Supports: The A2A 1.0 specification defines agent discovery, messages, tasks, artifacts, versioning, security, and multiple protocol bindings.
Model Context Protocol
Supports: Tool annotations and March 2025 tool semantics Tool annotations as descriptive hints rather than guarantees
Model Context Protocol
Supports: Last released initialization/session lifecycle before 2026 stateless core Last released handshake/session-era lifecycle before the 2026 revision.
Model Context Protocol
Supports: Official retrospective and Tasks explanation
Model Context Protocol
Supports: Annotations are untrusted hints, not enforcement or prompt-injection defenses
Model Context Protocol
Supports: Extensions are separate from core protocol and version independently
Model Context Protocol
Supports: Tasks are a separately versioned extension in the 2026 architecture
Model Context Protocol Python SDK
Supports: Modern versus handshake-era compatibility model
Model Context Protocol Python SDK
Supports: Local, remote and in-process client options Client connection forms: in-process, Streamable HTTP and stdio; client represents one server relationship.
Model Context Protocol TypeScript SDK
Supports: Per-era codecs and current auth migration details SDK implementation notes for discovery, identity and MRTR.
OpenAI
Supports: Current function definitions, tool loop, strict mode, tool choice and tool search
OpenAI
Supports: Remote MCP listing/calling, approvals and provider-hosted execution
OpenAI
Supports: Function tools, hosted MCP tools, tool search, namespaces and execution options
OpenAI
Supports: Distinction between constrained model output and external tool result structure
Anthropic
Supports: Messages API connection to remote MCP servers The beta Messages API connector uses tools from public HTTPS remote MCP servers over Streamable HTTP or legacy SSE.
Evidence note: First-party product documentation rechecked and normalized on 2026-08-25; the package URL remains in the package source map.
Supports: Gemini function declarations, developer execution, parallel/compositional calls and remote MCP
MCP Institute
Supports: Current SERP framing and comparison gaps
AI Agents Kit
Supports: Stateful-MCP comparison still appearing in results
Tetrate
Supports: Persistent-session framing and search-intent coverage
ClearPeaks
Supports: Example benchmark methodology and limits
Model Context Protocol
Supports: Late-2025 authorization semantics and registration options
NSA Artificial Intelligence Security Center
Supports: Government threat model and production recommendations; session-specific passages require version qualification
NSA
Supports: Release date, adoption context and continuum-of-security framing
IETF
Supports: Authorization-response issuer validation
IETF
Supports: Historical DCR mechanism now deprecated by current MCP
Invariant Labs
Supports: Practical cross-server/rug-pull demonstration
Zhou et al.
Supports: 7,973 live servers, authentication distribution, 119-server OAuth subset and nine CVEs; preprint with selection limits
Evidence note: Do not generalize OAuth flaw rates beyond the testable subset.
VIPER-MCP authors
Supports: Large-scale repository audit; 106 confirmed findings and 67 CVEs as reported by authors
Evidence note: Preprint statistics require method and version qualification.
Huang et al.
Supports: STRIDE/DREAD model and seven-client tool-poisoning evaluation
Shen, Toyoda and Leung
Supports: 38-category MCP threat taxonomy
Jamshidi et al.
Supports: Tool poisoning, shadowing, rug pulls and layered defense evaluation
Li et al.
Supports: Implicit tool poisoning and adaptive attack study
Liu et al.
Supports: Multi-tool threshold poisoning research
Turgut and Gümüş
Supports: Prompt-injection detector evaluation and limitations
Corvus study author
Supports: Dynamic audit of internet-facing servers; reported exposure and churn figures
Evidence note: Very recent preprint; preserve methodology caveats.
MCP Python SDK
Supports: Validation error amplification / denial of service; patched/fixed status: 1.9.4
Evidence note: Layer: SDK. Verify current affected and fixed ranges before publication.
MCP Python SDK
Supports: Closed-resource handling denial of service; patched/fixed status: 1.10.0
Evidence note: Layer: SDK. Verify current affected and fixed ranges before publication.
MCP Go SDK
Supports: DNS rebinding protection gap for localhost HTTP servers; patched/fixed status: 1.4.0
Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication.
MCP Java SDK
Supports: DNS rebinding protection gap for localhost HTTP servers; patched/fixed status: 1.0.0
Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication.
MCP Rust SDK
Supports: DNS rebinding protection gap; patched/fixed status: 1.4.0
Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication.
MCP Ruby SDK
Supports: DNS rebinding protection gap; patched/fixed status: 0.23.0
Evidence note: Layer: SDK/transport. Verify current affected and fixed ranges before publication.
MCP Ruby SDK
Supports: Protocol-session poisoning / state confusion in legacy session architecture; patched/fixed status: 0.23.0
Evidence note: Layer: SDK/session. Verify current affected and fixed ranges before publication.
MCP Ruby SDK
Supports: Unbounded stdio message handling can exhaust resources; patched/fixed status: 0.23.0 reported
Evidence note: Layer: SDK/stdio. Verify current affected and fixed ranges before publication.
MCP Ruby SDK
Supports: Legacy session retention / cleanup flaw; patched/fixed status: 0.23.0 reported
Evidence note: Layer: SDK/session. Verify current affected and fixed ranges before publication.
MCP TypeScript SDK
Supports: UriTemplate regular-expression denial of service; patched/fixed status: 1.25.2
Evidence note: Layer: SDK/parser. Verify current affected and fixed ranges before publication.
MCP reference Git server
Supports: Repository path validation weakness; patched/fixed status: 2025.9.25 / server removed
Evidence note: Layer: Server implementation. Verify current affected and fixed ranges before publication.
Official MCP Registry
Supports: Server-side request forgery in registry processing; patched/fixed status: 1.7.7
Evidence note: Layer: Registry. Verify current affected and fixed ranges before publication.
Official MCP Registry
Supports: OIDC token replay / validation flaw; patched/fixed status: 1.7.6
Evidence note: Layer: Registry/auth. Verify current affected and fixed ranges before publication.
Official MCP Registry
Supports: Open redirect; patched/fixed status: 1.7.5
Evidence note: Layer: Registry/web. Verify current affected and fixed ranges before publication.
Official MCP Registry
Supports: Stored cross-site scripting; patched/fixed status: LIVE-CHECK REQUIRED
Evidence note: Layer: Registry/web. Verify current affected and fixed ranges before publication.
Official MCP Registry
Supports: OCI verification fail-open behavior; patched/fixed status: 1.7.9
Evidence note: Layer: Registry/supply chain. Verify current affected and fixed ranges before publication.
Microsoft Playwright MCP
Supports: DNS rebinding against localhost HTTP mode; patched/fixed status: 0.0.40
Evidence note: Layer: Server/transport. Verify current affected and fixed ranges before publication.
Google MCP Toolbox for Databases
Supports: DNS rebinding in legacy SSE/local deployment; patched/fixed status: 1.2.0
Evidence note: Layer: Server/transport. Verify current affected and fixed ranges before publication.
CircleCI MCP Server
Supports: DNS rebinding protection weakness; patched/fixed status: 0.17.0
Evidence note: Layer: Server/transport. Verify current affected and fixed ranges before publication.
MCPJam Inspector
Supports: Remote command execution; patched/fixed status: 1.4.3
Evidence note: Layer: Host/developer tool. Verify current affected and fixed ranges before publication.
FastMCP
Supports: OAuth proxy callback missing consent binding; confused deputy; patched/fixed status: 3.2.0
Evidence note: Layer: Framework/auth. Verify current affected and fixed ranges before publication.
mcp-pinot
Supports: Network service bound broadly without authentication; patched/fixed status: 3.1.0
Evidence note: Layer: Server/deployment. Verify current affected and fixed ranges before publication.
GitHub MCP Server
Supports: Nil-pointer denial of service; patched/fixed status: 1.1.0
Evidence note: Layer: Server implementation. Verify current affected and fixed ranges before publication.
GitHub MCP Server
Supports: Lockdown mode cross-user authorization separation flaw; patched/fixed status: 1.1.2
Evidence note: Layer: Server/authorization. Verify current affected and fixed ranges before publication.
Kubernetes MCP Server
Supports: Presentation-only authorization without server-side enforcement; patched/fixed status: 3.6.0
Evidence note: Layer: Server/authorization. Verify current affected and fixed ranges before publication.
flyto-core
Supports: Unauthenticated command execution through MCP capability; patched/fixed status: 2.26.4
Evidence note: Layer: Server implementation. Verify current affected and fixed ranges before publication.
MySQL MCP Server
Supports: SQL injection through insufficient input handling; patched/fixed status: 0.3.0
Evidence note: Layer: Server implementation. Verify current affected and fixed ranges before publication.
aws-mcp
Supports: Command injection; patched/fixed status: No patch listed when recorded
Evidence note: Layer: Server implementation. Verify current affected and fixed ranges before publication.
Claude Code Action
Supports: Malicious repository .mcp.json can execute configured server code; patched/fixed status: 1.0.74
Evidence note: Layer: Host/project config. Verify current affected and fixed ranges before publication.
Apify MCP Server
Supports: Path/token authorization weakness; patched/fixed status: 0.10.11
Evidence note: Layer: Server/authorization. Verify current affected and fixed ranges before publication.
LibreChat
Supports: OAuth callback binding/account-linking weakness; patched/fixed status: 0.8.3-rc1 reported
Evidence note: Layer: Host/auth. Verify current affected and fixed ranges before publication.
LibreChat
Supports: Environment-expanded MCP URL can expose secrets; patched/fixed status: 0.8.4-rc1 reported
Evidence note: Layer: Host/configuration. Verify current affected and fixed ranges before publication.
LibreChat
Supports: Attacker-controlled headers can expose tokens; patched/fixed status: >=0.8.3-rc2
Evidence note: Layer: Host/auth. Verify current affected and fixed ranges before publication.
PraisonAI
Supports: Environment variables inherited by local MCP processes; patched/fixed status: 4.5.128
Evidence note: Layer: Host/local process. Verify current affected and fixed ranges before publication.
PraisonAI
Supports: Unsafe command parsing for MCP server configuration; patched/fixed status: Patched after 4.5.148
Evidence note: Layer: Host/local process. Verify current affected and fixed ranges before publication.
PraisonAI
Supports: Unauthenticated remote MCP connect path; patched/fixed status: 4.6.59
Evidence note: Layer: Host/network. Verify current affected and fixed ranges before publication.
PraisonAI
Supports: Arbitrary local file read through MCP integration; patched/fixed status: 4.6.40
Evidence note: Layer: Host/server. Verify current affected and fixed ranges before publication.
Nginx UI MCP integration
Supports: Unauthenticated MCP endpoint enabling administrative takeover; patched/fixed status: 2.3.4 reported
Evidence note: Layer: Server/product integration. Verify current affected and fixed ranges before publication.
mcp-remote
Supports: Command injection in remote-server launcher; patched/fixed status: LIVE-CHECK REQUIRED
Evidence note: Layer: Launcher/supply chain. Verify current affected and fixed ranges before publication.
Postmark MCP impersonator
Supports: Malicious npm package impersonating an official server and exfiltrating API keys; patched/fixed status: Remove package; use verified vendor source
Evidence note: Layer: Supply chain. Verify current affected and fixed ranges before publication.
Cursor
Supports: Malicious project MCP configuration can trigger code execution; patched/fixed status: 2025.09.17-25b418f
Evidence note: Layer: Host/project config. Verify current affected and fixed ranges before publication.
Zed
Supports: Malicious project MCP configuration can trigger code execution; patched/fixed status: 0.218.2-pre
Evidence note: Layer: Host/project config. Verify current affected and fixed ranges before publication.
OpenClaw
Supports: Owner identity spoofing in MCP-connected workflow; patched/fixed status: 2026.4.22
Evidence note: Layer: Host/identity. Verify current affected and fixed ranges before publication.
Model Context Protocol
Supports: Launch-era host, client and server roles and stateful capability-negotiated architecture.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Model Context Protocol
Supports: Launch-era protocol layering and absence of the later core authorization framework.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Model Context Protocol
Supports: Legacy architecture: host manages clients; each client maintains a stateful session with one server; isolation principles.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Model Context Protocol
Supports: Official TypeScript SDK v2 support for current MCP and examples of hosts connecting to servers.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Model Context Protocol
Supports: Modern versus legacy protocol eras and automatic compatibility behavior.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Model Context Protocol
Supports: Official SDK handling of both legacy and current protocol eras.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Model Context Protocol
Supports: Current connection behavior without an initialization handshake.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Model Context Protocol
Supports: Official Java client implementation responsibilities and transports.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Model Context Protocol
Supports: Official Java server implementation responsibilities and capabilities.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Anthropic
Supports: Anthropic distinguishes local desktop extensions from cloud-brokered remote connectors across supported Claude surfaces.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
Anthropic
Supports: Claude Code as an MCP host/client and optional MCP server through claude mcp serve.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
Anthropic
Supports: Claude Desktop local server configuration and management.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
OpenAI
Supports: Supported private, on-premises, and developer-machine MCP servers can be exposed to ChatGPT through Secure MCP Tunnel.
Evidence note: Added during the 2026-08-25 first-party product-source review; not part of the byte-exact research/5 archive.
OpenAI
Supports: Initial ChatGPT custom connector support through remote MCP.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
Microsoft
Supports: Initial VS Code MCP support in agent mode.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Microsoft
Supports: Agent harness responsibilities: context, model loop, tool calls and execution coordination.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
GitHub
Supports: GitHub Copilot cloud agent can use tools from configured MCP servers, subject to its documented capability, authentication, and approval limitations.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
GitHub
Supports: GitHub documents how to configure MCP servers for GitHub Copilot cloud agent.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
GitHub
Supports: Copilot Chat host/client behavior with a preconfigured GitHub MCP server and user approval.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
GitHub
Supports: Copilot CLI local and remote MCP server support.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
Cursor
Supports: Cursor as a host/client connecting to external MCP tools and data.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
Microsoft
Supports: Microsoft Agent Host is a distinct AHP runtime or process and should not be confused with the MCP host role.
Evidence note: Added during the 2026-08-25 first-party product-source review; not part of the byte-exact research/5 archive.
Supports: Gemini CLI registration and use of Google-hosted MCP servers.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Zed Industries
Supports: Zed host behavior around project trust and automatic MCP server execution.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Zed Industries
Supports: Host-level MCP tool allow, deny and confirm policy.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
JetBrains
Supports: JetBrains AI Assistant as MCP host/client; stdio, Streamable HTTP and legacy SSE support.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
JetBrains
Supports: JetBrains IDEs as MCP servers exposing IDE tools to external clients.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
JetBrains
Supports: Explicit distinction between JetBrains AI Assistant as client and the IDE as server.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
JetBrains
Supports: JetBrains host can pass configured MCP tools to several agent implementations.
Evidence note: Normalized from the checksum-verified research/5 architecture package; first-party product documentation rechecked and corrected on 2026-08-25.
Tricentis
Supports: Competitor page retaining initialize-based legacy architecture; used only for SERP gap analysis.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Stanza
Supports: Competitor page retaining initialization-centered architecture; used only for SERP gap analysis.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
MCP Server Spot
Supports: Competitor glossary using legacy session terminology; used only for SERP gap analysis.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Google Search Central
Supports: Unique title/meta, semantic HTML and DOM-accessible content.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Google Search Central
Supports: URL Inspection, sitemap submission and no guarantee of immediate indexing.
Evidence note: Normalized from the checksum-verified research/5 architecture package.
Cursor
Supports: Cursor CLI is a distinct MCP-consuming surface that shares MCP configuration with the Cursor editor.
Evidence note: Added during the 2026-08-25 first-party product-source review; not part of the byte-exact research/5 archive.
Zed Industries
Supports: Zed documents current MCP server configuration and its host-side MCP integration.
Evidence note: Added during the 2026-08-25 first-party product-source review; not part of the byte-exact research/5 archive.
Zed Industries
Supports: Restricted Mode blocks project-configured language and MCP servers until trust; globally configured servers are outside that gate.
Evidence note: Added during the 2026-08-25 first-party product-source review; not part of the byte-exact research/5 archive.
No records match those filters. Try a broader term.