Talk:Model Context Protocol

Template:AI-generated

Is Template:AI-generated still warranted to be included on this article at this point? What is a reasonable threshold for the article being modified enough to merit it's removal? -- 174.17.179.188 (talk) 15:18, 13 May 2025 (UTC)

Technical Error: TypeScript is NOT a programming language.

TypeScript is a static type checker for Javascript and not a programming language. Please consider revising this section. 12.50.30.18 (talk) 00:07, 29 August 2025 (UTC)

It looks like TypeScript is most usually considered a programming language, even though there is some debate on that. Alenoach (talk) 00:32, 29 August 2025 (UTC)

While you're not wrong that it's a type checker, it's widely treated as a programming language. TypeScript even has its own entry on Tiobe. Chumpih ^t 21:43, 29 August 2025 (UTC)

TypeScript is a superset to JavaScript, so yes, it's a programming language. When you say it is a static type checker, then you are probably talking about the actual program you use to apply TypeScript. That's like saying C is gcc. Maybe you should check back on how (programming) languages are defined in computer science. Croorg (talk) 21:03, 16 September 2025 (UTC)

Edit request: add protocol creators to Background

COI disclosure: I am David Soria Parra, an Anthropic employee and one of the two people named in this request. I am not editing the article directly per WP:COI.

Proposed change: In the Background section, immediately after the sentence ending ...development environments., insert the following sentence:

The protocol was created at Anthropic by engineers David Soria Parra and Justin Spahr-Summers.<ref name="anthropic-what-is-mcp">{{cite web |url=https://claude.com/blog/what-is-model-context-protocol |title=What is the Model Context Protocol? |publisher=Anthropic |date=October 31, 2025 |access-date=2026-04-29}}</ref><ref name="mcp-github-repo">{{cite web |url=https://github.com/modelcontextprotocol/modelcontextprotocol/blob/main/README.md |title=Model Context Protocol specification repository |website=GitHub |publisher=Model Context Protocol |access-date=2026-04-29}}</ref>

Rationale: This is a brief, neutral statement of authorship, comparable to how the Language Server Protocol and GraphQL articles name their originators in the history section. Both sources are primary/self-published, which is acceptable for an uncontroversial statement an organization makes about itself per WP:ABOUTSELF; the article already relies on Anthropic's announcement post for adjacent claims. No wikilinks are added for the names (neither has an article), and the sentence is kept out of the lead to avoid undue weight. Happy for the reviewer to adjust wording. ~2026-26094-54 (talk) 18:57, 29 April 2026 (UTC)

Done! I used a few different sources, as secondary sources are generally preferable and some editors are AI skeptical due to issues we've had with people editing using AI. We're actually currently developing a policy with regards to AI agents, and I think someone from a lab could really help out. MetalBreaksAndBends (talk) 16:46, 30 April 2026 (UTC)

Please do not encourage WP:COI editors to propose policy changes. Grayfell (talk) 17:54, 30 April 2026 (UTC)

References

clarification

I think I gathered from reading this that this can be used by an llm framework to communicate with tools. It's not directly used by the llm (by generating particular tokens)? Maybe a couple of examples would help ~2026-28205-13 (talk) 16:39, 9 May 2026 (UTC)

Expand Security section — proposal with wikitext and cited sources

This LLM-generated text has been collapsed and should be excluded from assessments of consensus.

The following discussion has been closed. Please do not modify it.

I propose expanding the Security section, which currently contains only one sentence, with properly cited subsections covering the security landscape that has developed around MCP since April 2025. All citations are from reliable secondary sources (The Register, The Hacker News, Dark Reading, Infosecurity Magazine, and arXiv academic preprints).

Rationale: The current one-sentence stub ("In April 2025, security researchers released an analysis...") does not adequately represent the substantial secondary-source coverage of MCP security issues. Topics including prompt injection, tool poisoning, rug pull attacks, supply-chain vulnerabilities, and dedicated security tooling have been covered in detail by multiple established tech publications.

Proposed replacement for the entire Security section:

== Security == === Overview === MCP's architecture introduces security challenges that differ from those of traditional application programming interfaces (APIs). Unlike HTTP APIs, where responses are consumed by deterministic code, MCP tool outputs are interpreted by a [[large language model]] and become part of its [[context window]] — the working memory in which the model reasons and acts. Attacker-controlled content within those outputs can therefore function as instructions to the model rather than simply as data.<ref>{{cite web|last=Lakshmanan|first=Ravie|date=30 April 2025|title=Researchers Demonstrate How MCP Prompt Injection Can Be Used for Both Attack and Defense|url=https://thehackernews.com/2025/04/experts-uncover-critical-mcp-and-a2a.html|website=[[The Hacker News]]|access-date=2026-05-13}}</ref> A 2025 academic survey of MCP identified five principal threat categories: [[prompt injection]], tool poisoning, excessive permission grants, rug pull attacks, and supply-chain compromise.<ref>{{cite arXiv|last1=Hou|first1=Xinyi|last2=Zhao|first2=Yanjie|last3=Wang|first3=Shenao|last4=Wang|first4=Haoyu|date=2025|title=Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions|eprint=2503.23278|class=cs.CR}}</ref> === Prompt injection === [[Prompt injection]] in MCP occurs when user-controlled or attacker-controlled content — such as the body of a code repository issue, a retrieved document, or a web page fetched by an MCP tool — contains text designed to be interpreted as instructions by the underlying language model. Because MCP servers typically return external content without labeling it as untrusted, models cannot reliably distinguish between operator instructions and attacker-supplied data.<ref>{{cite web|last=Lakshmanan|first=Ravie|date=30 April 2025|title=Researchers Demonstrate How MCP Prompt Injection Can Be Used for Both Attack and Defense|url=https://thehackernews.com/2025/04/experts-uncover-critical-mcp-and-a2a.html|website=The Hacker News|access-date=2026-05-13}}</ref> A demonstrated attack scenario involves an adversary writing malicious instructions into a code repository issue or collaboration platform ticket. When a developer's AI coding assistant fetches the issue via an MCP server, the injected instructions enter the model's context and may cause it to exfiltrate repository secrets or perform unauthorized actions.<ref>{{cite web|last1=Beurer-Kellner|first1=Luca|last2=Fischer|first2=Marc|date=1 April 2025|title=MCP Security Notification: Tool Poisoning Attacks|url=https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks|website=Invariant Labs|access-date=2026-05-13}}</ref> In January 2026, ''[[The Register]]'' reported that Anthropic had quietly patched two prompt-injection vulnerabilities — CVE-2025-68145 and CVE-2025-68144 — in its official Git MCP server after researchers found that the server failed to validate repository path arguments and passed user-controlled input to the underlying GitPython library without sanitization.<ref>{{cite web|date=20 January 2026|title=Anthropic quietly fixed flaws in its Git MCP server|url=https://www.theregister.com/2026/01/20/anthropic_prompt_injection_flaws/|website=The Register|access-date=2026-05-13}}</ref> === Tool poisoning === Tool poisoning refers to the embedding of malicious instructions inside the text of an MCP tool's name, description, or parameter definitions — fields that language models read as part of their context but that are not displayed to end users in most MCP client interfaces. Because MCP clients present tool descriptions as trusted content when constructing an agent's prompt, a server operator or supply-chain attacker who controls those descriptions can direct the model to exfiltrate data or bypass safeguards.<ref>{{cite web|last1=Beurer-Kellner|first1=Luca|last2=Fischer|first2=Marc|date=1 April 2025|title=MCP Security Notification: Tool Poisoning Attacks|url=https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks|website=Invariant Labs|access-date=2026-05-13}}</ref> A 2025 study by Hidden Layer demonstrated that shadow tools — malicious MCP servers whose names and descriptions closely mimic those of legitimate tools — can silently intercept tool calls when multiple MCP servers are loaded within the same agent session.<ref>{{cite web|last1=Schulz|first1=Kasimir|last2=Martin|first2=Jason|last3=Kan|first3=Marcus|last4=Yeung|first4=Kenneth|last5=McCauley|first5=Conor|last6=Ring|first6=Leo|date=10 April 2025|title=MCP: Model Context Pitfalls in an Agentic World|url=https://hiddenlayer.com/innovation-hub/mcp-model-context-pitfalls-in-an-agentic-world/|website=Hidden Layer|access-date=2026-05-13}}</ref> === Rug pull attacks === A rug pull attack occurs when an MCP server that was initially benign is subsequently updated with malicious tool descriptions or behaviors. The MCP protocol specification, as of 2026, includes no mechanism to notify clients of server-side changes to tool definitions; an agent that trusted a server at the time of installation will therefore continue to invoke it after a malicious update without re-verification or re-approval.<ref>{{cite web|last1=Schulz|first1=Kasimir|last2=Martin|first2=Jason|last3=Kan|first3=Marcus|last4=Yeung|first4=Kenneth|last5=McCauley|first5=Conor|last6=Ring|first6=Leo|date=10 April 2025|title=MCP: Model Context Pitfalls in an Agentic World|url=https://hiddenlayer.com/innovation-hub/mcp-model-context-pitfalls-in-an-agentic-world/|website=Hidden Layer|access-date=2026-05-13}}</ref> Researchers proposed ''tool pinning'' — cryptographically hashing tool descriptions at first use and alerting users when hashes change on subsequent scans — as a countermeasure to detect rug pull events.<ref>{{cite web|last1=Beurer-Kellner|first1=Luca|last2=Fischer|first2=Marc|date=1 April 2025|title=MCP Security Notification: Tool Poisoning Attacks|url=https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks|website=Invariant Labs|access-date=2026-05-13}}</ref> === Supply-chain vulnerabilities and architectural concerns === In April 2026, security firm OX Security published research identifying a design-level vulnerability in MCP's use of [[standard streams|STDIO]] transport, estimating that the flaw could affect up to 200,000 MCP server instances and software packages totalling more than 150 million downloads.<ref>{{cite web|date=16 April 2026|title=MCP 'design flaw' puts 200k servers at risk: Researcher|url=https://www.theregister.com/2026/04/16/anthropic_mcp_design_flaw/|website=The Register|access-date=2026-05-13}}</ref><ref>{{cite web|title=Systemic Flaw in MCP Protocol Could Expose 150 Million Downloads|url=https://www.infosecurity-magazine.com/news/systemic-flaw-mcp-expose-150/|website=Infosecurity Magazine|access-date=2026-05-13}}</ref> The researchers found that the STDIO transport mechanism could be exploited to achieve unauthenticated command injection, because it accepted arbitrary operating system commands rather than validating that the spawned process was a legitimate MCP server. Anthropic declined to modify the protocol's architecture, characterizing the behavior as expected and noting that mitigations were the responsibility of individual server implementers.<ref>{{cite web|date=16 April 2026|title=MCP 'design flaw' puts 200k servers at risk: Researcher|url=https://www.theregister.com/2026/04/16/anthropic_mcp_design_flaw/|website=The Register|access-date=2026-05-13}}</ref> ''[[Dark Reading]]'' described certain MCP security issues as architectural rather than implementation-specific, meaning they cannot be addressed through individual software patches and require protocol-level design changes to fully remediate.<ref>{{cite web|title=AI Conundrum: Why MCP Security Can't Be Patched Away|url=https://www.darkreading.com/application-security/mcp-security-patched|website=Dark Reading|access-date=2026-05-13}}</ref> === Security tools and classification standards === In response to the identified risks, several security tools and classification frameworks emerged. Invariant Labs, an ETH Zurich spin-off, released mcp-scan, an open-source tool that detects tool poisoning, rug pull attempts, and prompt injection in locally installed MCP servers by hashing tool descriptions and flagging changes between scans. Snyk acquired the tool in June 2025 and integrated it into its agentic AI security product line.<ref>{{cite web|title=MCP-Scan Review 2026: Security Scanner for MCP Servers|url=https://appsecsanta.com/mcp-scan|website=AppSec Santa|access-date=2026-05-13}}</ref> The [[OWASP]] MCP Top 10, published in 2025, provided the first formal classification of security risks specific to MCP deployments, organized analogously to OWASP's foundational web application and LLM risk lists.<ref>{{cite web|title=MCP Security in 2026: Tool Poisoning, OWASP MCP Top 10, and How to Protect Your Agents|url=https://mcpplaygroundonline.com/blog/mcp-security-tool-poisoning-owasp-top-10-mcp-scan|website=MCP Playground|access-date=2026-05-13}}</ref> Researchers proposed the Enhanced Tool Definition Interface (ETDI) as a protocol extension that adds [[OAuth]]-based cryptographic signatures and policy-based access control to MCP tool definitions, designed to mitigate tool squatting and rug pull attacks without requiring changes to the base MCP specification.<ref>{{cite arXiv|date=2025|title=ETDI: Mitigating Tool Squatting and Rug Pull Attacks in Model Context Protocol (MCP) by using OAuth-Enhanced Tool Definitions and Policy-Based Access Control|eprint=2506.01333}}</ref>

Truongbuinh (talk)

 Not done. We don't take AI-generated text. Also, your AI went astray a bit here, several of the citations it thinks are reliable are not, in fact, reliable. - MrOllie (talk) 16:35, 14 May 2026 (UTC)

The article says at the top some sources may not be reliable then you tell me the links I added aren't reliable. This is silly, the article is insanely thin and has been missing key pieces like CMS since the start, but sure you don't like the sources which were mostly other wiki pages. Understand you aren't an arbitrator of truth and you are part of the problem ollie Squashbird (talk) 05:09, 26 May 2026 (UTC)

I think MrOllie is right, but it's also true that Wikipedia's norms around what sources are considered acceptable are strict and opaque to newcomers. Rules of thumb: blogs and other self-published sources should generally avoided, prefer professional journalism or peer-reviewed scientific articles. See Wikipedia:Reliable sources/Perennial sources for a community assessment of the reliability of some well-known sources. Alenoach (talk) 19:24, 26 May 2026 (UTC)

In the case of Squashbird's addition, not only were the citations unreliable, it also had the effect of making a list of vendors - that is just as a big a problem per WP:NOT. MrOllie (talk) 19:35, 26 May 2026 (UTC)