MCP security research, tool discovery deep dives, and AI-agent infrastructure engineering notes from the MCPProxy team.https://mcpproxy.app/en-ushttps://mcpproxy.app/blog/2026-10-04-mcpproxy-v0-70-0-profiles-and-agents-that-find-their-tools/https://mcpproxy.app/blog/2026-10-04-mcpproxy-v0-70-0-profiles-and-agents-that-find-their-tools/v0.70.0 adds profiles with per-tool policy, gives every connected client its own scoped credential, reworks navigation around one needs-attention list, and tells agents which servers they can reach, so they stop reaching for gh and curl.Sun, 04 Oct 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-08-26-mcpproxy-v0-61-0-reconnect-storms-and-scans-that-run/https://mcpproxy.app/blog/2026-08-26-mcpproxy-v0-61-0-reconnect-storms-and-scans-that-run/v0.61.0 stops the proxy from re-dialing dead upstreams ~9,000 times a day, makes the free security scan run on every new server instead of almost never, masks secrets in the Web UI, and closes 47 findings from two UX audits.Wed, 26 Aug 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-05-10-three-independent-bodies-converge-on-admission-control/https://mcpproxy.app/blog/2026-05-10-three-independent-bodies-converge-on-admission-control/In the first four months of 2026, three independent security bodies — Forrester, OWASP, and Singapore's IMDA — each published a major framework for agentic AI security. None coordinated. None cite each other. All three converged on the same architectural requirement at the MCP protocol layer: a default-deny admission control gate.Sun, 10 May 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-05-10-nine-seconds-production-wipe-admission-gate/https://mcpproxy.app/blog/2026-05-10-nine-seconds-production-wipe-admission-gate/A Cursor + Claude Opus 4.6 agent wiped PocketOS production in nine seconds on May 9, 2026. Backups were on the same volume. Railway had evals. The evals didn't help. The missing layer was an admission gate, not better evals.Sun, 10 May 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-05-05-csai-mcp-cve-numbering-authority/https://mcpproxy.app/blog/2026-05-05-csai-mcp-cve-numbering-authority/The Cloud Security Alliance's CSAI Foundation registered as a CVE Numbering Authority in April 2026 — the first AI-specific CNA in the ecosystem, with explicit scope over MCP server vulnerabilities. Every CSAI CVE is a re-review event waiting for an admission record to match against.Tue, 05 May 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-05-05-datadog-agent-sprawl-fleet-inventory/https://mcpproxy.app/blog/2026-05-05-datadog-agent-sprawl-fleet-inventory/Datadog's State of AI Engineering 2026 named the consequence of running multiple models in production: agent sprawl. Their prescribed remedy is fleet inventory tracking. At the MCP layer, that inventory has to be created at admission — not retroactively from telemetry.Tue, 05 May 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-05-05-gravitee-85-percent-it-approval-gap/https://mcpproxy.app/blog/2026-05-05-gravitee-85-percent-it-approval-gap/Gravitee's State of AI Agent Security 2026 quantified the Shadow MCP problem with a single number: only 14.4% of organizations have full IT approval for their agent fleet. The remaining 85.6% is the deployment surface MCPProxy is built to address.Tue, 05 May 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-04-28-one-endpoint-every-client/https://mcpproxy.app/blog/2026-04-28-one-endpoint-every-client/Claude Desktop, Claude Code, Cursor, Codex CLI, Gemini CLI — five clients, one MCP config to maintain. A three-minute walkthrough of mcpproxy upstream import and a single localhost:8080/mcp endpoint that replaces them all.Tue, 28 Apr 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-04-24-cut-agent-tool-context-97-percent/https://mcpproxy.app/blog/2026-04-24-cut-agent-tool-context-97-percent/A measured before/after: 54,707 tokens of MCP tool definitions shrunk to 818 tokens using a single retrieve_tools meta-tool. The configs, the methodology, and the honest caveats.Fri, 24 Apr 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-04-20-anthropic-expected-behavior-security-layer/https://mcpproxy.app/blog/2026-04-20-anthropic-expected-behavior-security-layer/OX Security found that Anthropic's MCP STDIO transport lets anyone execute arbitrary OS commands. Anthropic called it expected behavior. Ten CVEs later, somebody has to provide the security defaults the protocol won't.Mon, 20 Apr 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-04-20-attack-gets-better-ai-gets-smarter/https://mcpproxy.app/blog/2026-04-20-attack-gets-better-ai-gets-smarter/Unit 42's MCPTox benchmark found 72.8% attack success on o1-mini. More capable models are more vulnerable to MCP sampling injection because the attack exploits instruction-following. You cannot model-upgrade your way out of this.Mon, 20 Apr 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-04-19-mcp-remote-client-rce/https://mcpproxy.app/blog/2026-04-19-mcp-remote-client-rce/Every previous MCP CVE ran on the server. mcp-remote CVSS 9.6 runs on your laptop — and it fires before you make a single tool call.Sun, 19 Apr 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-04-19-agent-security-stack-2026/https://mcpproxy.app/blog/2026-04-19-agent-security-stack-2026/Three independent vendors are building three layers of the agent security stack. Ledger for identity. MCPProxy for admission. NemoClaw for execution. Nobody has named the full stack until now.Sun, 19 Apr 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-04-17-mcp-bidirectional-trust-boundaries/https://mcpproxy.app/blog/2026-04-17-mcp-bidirectional-trust-boundaries/SEP-2571 proposes write operations in MCP for the first time. When clients can create resources on servers, cross-client contamination becomes a protocol-level attack surface.Fri, 17 Apr 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-04-13-four-layers-mcp-security/https://mcpproxy.app/blog/2026-04-13-four-layers-mcp-security/A comparison article this week reviewed three MCP security tools. It missed the two layers that matter most. Here is the full four-layer stack — and why the order you deploy them matters.Mon, 13 Apr 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-04-10-agents-txt-expired/https://mcpproxy.app/blog/2026-04-10-agents-txt-expired/draft-srijal-agents-policy-00 expired today with no working group adoption and 11 competing drafts still fighting for relevance. Here's why MCPProxy's security posture is unaffected by any of it.Fri, 10 Apr 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-04-07-cvss-91-azure-mcp-server-cve-enterprise-wake-up-call/https://mcpproxy.app/blog/2026-04-07-cvss-91-azure-mcp-server-cve-enterprise-wake-up-call/CVE-2026-32211 proves that even Microsoft ships MCP servers with missing authentication. Nine confirmed MCP CVEs in one quarter demand a quarantine-first architecture.Tue, 07 Apr 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-31-three-sandboxes-ai-isolation/https://mcpproxy.app/blog/2026-03-31-three-sandboxes-ai-isolation/Cloudflare chose V8 isolates, Anthropic chose OS-native primitives, MCPProxy chose Docker containers. All three are correct — for different threat models. Here is the design space.Tue, 31 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-27-mcp-spec-converging-mcpproxy-architecture/https://mcpproxy.app/blog/2026-03-27-mcp-spec-converging-mcpproxy-architecture/MCP specification discussions on gateway authorization, tool integrity, and quarantine patterns are converging toward the architecture MCPProxy has been shipping since day one.Fri, 27 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-27-mcpwned-rsac-azure-rce/https://mcpproxy.app/blog/2026-03-27-mcpwned-rsac-azure-rce/Token Security's MCPwned presentation at RSAC 2026 demonstrated CVSS 9.8 RCE in Azure MCP Server. The attack chain exploits MCP's trust-by-default model. Here is what it means and how to defend.Fri, 27 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-25-cisco-defenseclaw-vs-mcpproxy/https://mcpproxy.app/blog/2026-03-25-cisco-defenseclaw-vs-mcpproxy/Cisco's DefenseClaw and MCPProxy take fundamentally different approaches to MCP security. Here is an honest comparison of architectures, trade-offs, and when to use each.Wed, 25 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-24-first-malicious-mcp-server-exfiltration/https://mcpproxy.app/blog/2026-03-24-first-malicious-mcp-server-exfiltration/The postmark-mcp npm package secretly BCC'd every outgoing email to attackers for weeks. MCPwned demonstrated CVSS 9.8 Azure RCE. Both share the same root cause: MCP servers run trusted by default.Tue, 24 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-24-cant-patch-mcp-security-architecture/https://mcpproxy.app/blog/2026-03-24-cant-patch-mcp-security-architecture/Netskope told RSAC 2026: MCP vulnerabilities are architectural. Only 20% get remediated vs 70% for traditional APIs. Patches don't reach protocol-level attack surfaces. Architecture does.Tue, 24 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-23-cve-2026-23744-discovery-pipeline/https://mcpproxy.app/blog/2026-03-23-cve-2026-23744-discovery-pipeline/A crafted HTTP request to MCPJam Inspector triggers installation of a malicious MCP server and full RCE. The attack surface is not your tools — it is the mechanism by which you find and install tools.Mon, 23 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-23-google-cloud-mcp-default-governance/https://mcpproxy.app/blog/2026-03-23-google-cloud-mcp-default-governance/Google Cloud enabled fully-managed remote MCP servers across ALL services by default. Every Google Cloud customer now needs to answer: who governs your AI agents' access to production infrastructure?Mon, 23 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-22-three-gates-ai-infrastructure/https://mcpproxy.app/blog/2026-03-22-three-gates-ai-infrastructure/Traefik's Triple Gate architecture makes it explicit: API gateways, AI gateways, and MCP gateways are three distinct infrastructure layers. Here is why MCP needs its own gateway and how MCPProxy fits.Sun, 22 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-21-mcp-gateway-market-split/https://mcpproxy.app/blog/2026-03-21-mcp-gateway-market-split/The MCP gateway market has visibly split into enterprise commercial platforms and open-source builder tools. This is the same pattern that shaped the API gateway market — and open source won there too.Sat, 21 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-21-mcp-linux-foundation-gateways/https://mcpproxy.app/blog/2026-03-21-mcp-linux-foundation-gateways/Anthropic donated MCP to the Linux Foundation's Agentic AI Foundation, co-founded with Block and OpenAI. MCP gateways just moved from developer tool to mandatory enterprise infrastructure.Sat, 21 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-21-meta-ai-safety-agent-gateway/https://mcpproxy.app/blog/2026-03-21-meta-ai-safety-agent-gateway/Meta's Director of Alignment watched her AI agent delete hundreds of emails despite explicit instructions. Combine this with 88% of orgs reporting AI agent incidents. Gateway-level controls are no longer optional.Sat, 21 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-21-mcpwned-config-attack-vector/https://mcpproxy.app/blog/2026-03-21-mcpwned-config-attack-vector/Check Point's MCPwned RCE via .claude/settings.json, Azure MCP SSRF CVE-2026-26118, and 30+ CVEs reveal a new attack class: configuration-as-code-execution. Here is how gateways defend against it.Sat, 21 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-20-gartner-mcp-proxies-what-we-built/https://mcpproxy.app/blog/2026-03-20-gartner-mcp-proxies-what-we-built/Gartner now recommends MCP gateways for enterprise AI agent deployments. Here is how the landscape looks, what MCPProxy brings, and what is still missing across the entire category.Fri, 20 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-20-mcp-breach-timeline-lessons/https://mcpproxy.app/blog/2026-03-20-mcp-breach-timeline-lessons/AuthZed's MCP breach timeline documents recurring vulnerability patterns from April to December 2025. Every pattern maps to defenses MCPProxy already ships.Fri, 20 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-20-cve-2026-27896-go-json-mcp/https://mcpproxy.app/blog/2026-03-20-cve-2026-27896-go-json-mcp/CVE-2026-27896 exploits Go's case-insensitive JSON parsing to bypass MCP security controls. Here is how the attack works, whether MCPProxy is affected, and what every Go-based MCP tool needs to fix.Fri, 20 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-19-bm25-accuracy-hybrid-search/https://mcpproxy.app/blog/2026-03-19-bm25-accuracy-hybrid-search/BM25 achieves 14% Top-1 accuracy across 916 tools. Hybrid semantic+BM25 reaches 94%. Here is MCPProxy's roadmap from pure BM25 to hybrid search.Thu, 19 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-19-bm25-vs-embeddings-vs-lua/https://mcpproxy.app/blog/2026-03-19-bm25-vs-embeddings-vs-lua/MCP tool definitions consume 55K+ tokens. Four approaches compete to solve this: BM25, embeddings, Lua scripting, and built-in tool search. Here is how they compare.Thu, 19 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-18-contextcrush-dockerdash-trusted-servers/https://mcpproxy.app/blog/2026-03-18-contextcrush-dockerdash-trusted-servers/Two real-world MCP supply chain attacks prove the trusted server assumption is broken. ContextCrush weaponized a 50K-star server; DockerDash turned image metadata into RCE. Here is what gateway-level security looks like.Wed, 18 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-18-docker-isolation-zombie-containers/https://mcpproxy.app/blog/2026-03-18-docker-isolation-zombie-containers/Claude Code's MCP config silently orphans Docker containers. The community response is to abandon Docker — but that trades isolation for convenience. Here is why Docker done right beats no Docker at all.Wed, 18 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-18-defense-in-depth-mcp-identity/https://mcpproxy.app/blog/2026-03-18-defense-in-depth-mcp-identity/The MCP security market has fragmented into distinct layers. MCPS adds cryptographic identity, MCPProxy provides gateway-level quarantine and isolation, and G0 handles static analysis. Here is why you need all three.Wed, 18 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-18-perplexity-cto-bm25-context-window/https://mcpproxy.app/blog/2026-03-18-perplexity-cto-bm25-context-window/Perplexity CTO Denis Yarats publicly moved away from MCP citing context window bloat. MCPProxy's BM25 tool discovery was built to solve exactly this problem — reducing 54K tokens to under 1K.Wed, 18 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-18-mcp-security-landscape-gateway-needs/https://mcpproxy.app/blog/2026-03-18-mcp-security-landscape-gateway-needs/100% of MCP servers lack permission declarations, the average security score is 34/100, and the emerging security tooling stack is fragmenting fast. Here is what every MCP gateway needs to address.Wed, 18 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-15-mcp-gateway-landscape/https://mcpproxy.app/blog/2026-03-15-mcp-gateway-landscape/The MCP gateway market has exploded in 2026 with Microsoft, IBM, and Docker all shipping solutions. Here is how the landscape looks and where MCPProxy's BM25 discovery and quarantine set it apart.Sun, 15 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-15-beyond-bm25-tool-discovery/https://mcpproxy.app/blog/2026-03-15-beyond-bm25-tool-discovery/New benchmarks show BM25 alone hits 14% top-1 accuracy for large tool sets. Here is what we have learned, why hybrid search is the future, and how MCPProxy is evolving.Sun, 15 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-13-mcpproxy-filesystem-monitoring/https://mcpproxy.app/blog/2026-03-13-mcpproxy-filesystem-monitoring/MCPProxy already provides Docker isolation, quarantine, and sensitive data detection. The next frontier: monitoring what files stdio MCP servers touch using OS-level sandboxing.Fri, 13 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2026-03-13-mcpproxy-tool-annotations-routing/https://mcpproxy.app/blog/2026-03-13-mcpproxy-tool-annotations-routing/MCPProxy's DeriveCallWith system maps MCP tool annotations to read/write/destructive tool variants, enabling annotation-based access control and intent validation.Fri, 13 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/why-bm25-outperforms-vector-search-for-mcp-tool-discovery/https://mcpproxy.app/blog/why-bm25-outperforms-vector-search-for-mcp-tool-discovery/When your AI agent connects to 20+ MCP servers with hundreds of tools, how do you find the right one? We chose BM25 over vector search — here's why.Thu, 12 Mar 2026 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2025-08-27-mcp-evaluation/https://mcpproxy.app/blog/2025-08-27-mcp-evaluation/Automated testing for AI agents is fundamentally different from traditional software testing due to non-deterministic behavior. This post surveys current approaches for evaluating Model Context Protocol (MCP) tool quality, and demonstrates how these methods are implemented in our open-source mcp-eval utility. We cover trajectory-based evaluation, similarity scoring, and practical Docker-based testing architectures that handle the inherent variability of LLM systems while maintaining testing reliability.Wed, 27 Aug 2025 00:00:00 GMTAlgis Dumbrishttps://mcpproxy.app/blog/2025-08-10-productivity-tools-for-ai-agents/https://mcpproxy.app/blog/2025-08-10-productivity-tools-for-ai-agents/The Model Context Protocol (MCP), challenges of direct tool integration, and how MCPProxy solves tool overload with retrieval and security.Sun, 10 Aug 2025 00:00:00 GMTAlgis Dumbris