docs(security): SAFE-MCP advisory — Ed25519 → MCPS Tool Definition Signing, OWASP refs - #30
Conversation
Adds content/docs/security/ section: - security/index.mdx — section landing page - security/safe-mcp-advisory.mdx — three HIGH findings for self-hosted ops: G-01: unpinned npm MCP packages G-02: no manifest signing G-03: floating plugin references Updates meta.json with Security nav section. Pairs with: monorepo PRs #808, #809 Deadline: April 22, 2026 Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sourced from Research Lead synthesis 2026-04-18 22:52 UTC.
Changes:
- G-02 long-term mitigation: replaced vague "Ed25519" with MCPS
Tool Definition Signing (ECDSA P-256, schema hash pinning, rug pull
protection, targeting MCPS L3 trust level)
- Added "Normative References" section citing:
- MCP04:2025 — Software Supply Chain Attacks & Dependency Tampering
(signed components, version pinning, SBOM/CBOM, dependency scanning)
- MCP09:2025 — Shadow MCP Servers
(central governance, discovery/scanning, baseline configs)
- MCPS — Cryptographic Security Layer for MCP
(tool definition signing, trust levels L0–L4)
- Annotated each remediation checklist item with the OWASP control
that motivates it
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
…dvisory Terminology fix: all references to the repo now use the correct name molecule-core (was molecule-monorepo). No content changes beyond the repo name update. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
QA Review — APPROVEClear, actionable security documentation. Three HIGH-severity findings documented with remediation checklists. Correct scoping (self-hosted vs SaaS). OWASP control ID annotations present. MERGE ORDER NOTE (per PR body): must merge before PR #31 (docs/owasp-agentic-top-10). |
Build Fix RequiredThis PR has a Vercel build failure — MDX/Turbopack cannot parse bare URLs in angle brackets (line 218, 237, 250 of safe-mcp-advisory.mdx): The three affected lines use Apply this patch to fix: ```bash In content/docs/security/safe-mcp-advisory.mdx:Line ~218: Change:https://github.com/OWASP/www-project-mcp-top-10 To:Line ~237: Change:https://github.com/OWASP/www-project-mcp-top-10 To:Line ~250: Change:To:Verified: |
1 participant
Summary
docs/owasp-agentic-top-10Test plan
Pairs with: Molecule-AI/molecule-core PRs #808, #809
🤖 Generated with Claude Code