NSA Issues MCP Security Design Considerations: What the Government Advisory Means for Your AI Agent Stack

compliance review free stock image for MCPwatch editorial use — Compliance review: the NSA CSI provides government-grade security design considerations for MCP-powered AI automation stacks. Source: Openverse/flickr, CC BY 2.0.

What Happened

On May 20, 2026, the US National Security Agency’s Artificial Intelligence Security Center (AISC) published a Cybersecurity Information Sheet (CSI) titled “Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation”. This is the first formal US government cybersecurity advisory specifically addressing the security of the Model Context Protocol ecosystem — the rapidly growing standard that connects AI agents to external tools, data sources, and services.

The CSI document was co-sealed by CISA, the FBI, and allied international cybersecurity agencies. It is not a theoretical exercise: it directly responds to the explosion of MCP server deployments across enterprise environments and the documented security gaps that researchers and defenders have been disclosing since early 2025.

The advisory identifies the following core risk areas in MCP deployments:

Tool poisoning: Malicious or compromised MCP tool descriptions can inject instructions into LLM agents, causing them to perform unauthorized actions, exfiltrate data, or bypass access controls. The NSA notes that Microsoft’s own research confirmed a 72.8% tool poisoning success rate across 45 tested MCP servers.
Cross-origin data leakage: MCP servers that serve multiple clients or connect to multiple data sources risk leaking information across trust boundaries. A compromised or misconfigured server can bridge isolated data domains.
Missing authentication: The advisory highlights that a significant proportion of deployed MCP servers operate without any authentication, allowing any client on the network to invoke tools and read resources.
Insecure transport defaults: Many MCP server implementations default to unencrypted STDIO transport or HTTP without TLS, exposing tool calls and responses to network-level eavesdropping.
Excessive permission grants: Agents routinely receive broader tool and resource access than their tasks require, violating least-privilege principles.

The CSI also addresses the MCP specification’s own security best practices, including the newly introduced OAuth 2.1 authorization framework for remote MCP servers (added in the 2025-03-26 protocol revision), and stresses that adoption of these protections remains uneven across the ecosystem.

Why It Matters for MCP and Agent-Tool Endpoints

The NSA CSI validates what security researchers and MCP watchdog operators have been tracking since early 2025. Key implications:

1. Tool poisoning is now officially a recognized attack class

Until now, tool poisoning was discussed primarily in research circles and security conference presentations. The NSA CSI elevates it to a government-advisory-level concern. Any organization deploying MCP servers — whether as internal tool endpoints or public registries — must now treat tool description integrity as a security boundary, not just a UX concern.

2. Authentication is no longer optional

The CSI explicitly recommends that MCP servers implement the OAuth 2.1 authorization framework defined in the MCP specification. This directly impacts organizations running MCP servers with no authentication, which recent scanning data suggests includes 38–41% of public MCP servers. The days of deploying MCP endpoints without auth and hoping they remain internal-only are over.

3. Cross-origin data leakage mirrors the GitLost class of attacks

The advisory’s emphasis on cross-origin data leakage aligns with the GitLost vulnerability disclosed in July 2026: when an AI agent can read from one trust domain and write to another, while holding access to a third, any injection in the read domain can exfiltrate data from the privileged domain. The NSA is now formally warning that MCP’s architecture amplifies this pattern.

4. Supply-chain risk in MCP registries

With the launch of the official MCP Registry in early 2026, the CSI’s guidance on verifying tool descriptions, provenance, and runtime behavior applies directly to the trust model of registry-hosted servers. A registry listing does not guarantee security.

Practical Defensive Takeaways

Enable OAuth 2.1 authorization on every remote MCP server. The MCP specification now defines an OAuth-based authorization flow for remote (Streamable HTTP) servers. Deploy it. Do not run production MCP endpoints without authentication.
Enforce TLS on all MCP transports. Use HTTPS for Streamable HTTP servers. For STDIO-based local servers, restrict which processes can connect and ensure host-level security controls are in place.
Apply least-privilege scoping to MCP tool grants. Inventory every tool, resource, and prompt each agent can access. Remove broad “all-tools” or “org-wide” access in favor of per-task scoping.
Validate and sign tool descriptions. Treat MCP tool descriptions as code. Review them for injection content, pin them to known-good versions, and verify provenance from registry listings before enabling them in production agents.
Segregate MCP servers by trust domain. Do not allow a single MCP server to serve both public-facing and private data sources. Use separate servers with separate authentication boundaries.
Monitor and log all MCP tool invocations. Centralize logs for tool calls, resource reads, and prompt renders. Alert on anomalous patterns: unexpected tool calls, cross-boundary data access, or authentication failures.
Apply the MCP Tool Poisoning Defense Pack recommendations. Validate tool descriptions, sandbox agent tool calls, and strip or neutralize instruction-like content in untrusted inputs.
Run the Pre-Deployment MCP Audit Workflow before enabling any new MCP server. Check for excessive permission grants, missing authentication, and cross-boundary data flows.

What Teams Should Check Next

Read the full NSA CSI. Download the PDF at nsa.gov/Portals/75/documents/Cybersecurity/CSI_MCP_SECURITY.pdf and distribute it to your security and platform engineering teams.
Inventory every MCP server in your environment. For each server, verify: authentication mechanism, transport encryption, tool description provenance, and data source access scope.
Check if your MCP servers have OAuth 2.1 enabled. If not, plan a migration path. The specification’s authorization framework is now a government-recommended baseline.
Review the MCP Security Best Practices documentation on modelcontextprotocol.io. The official guidance aligns with the NSA CSI and provides implementation details.
Audit your MCP server registries and package sources. Verify that every listed tool server has a known maintainer, signed descriptions, and a recent security review. Remove or disable any that do not.
Monitor MCPwatch’s MCP Security hub for related hardening guidance and ongoing CVE coverage.