MCP Security Gap: NSA Guidance Arrives Before Tools Are Ready

A protocol growing faster than its defenses

The Model Context Protocol (MCP) has quickly become the standard way AI agents connect to external tools, data sources and developer environments. Its security tooling has not kept pace. Three recent developments show the gap: new hardening guidance from the National Security Agency, an independent audit of open-source MCP scanners, and a series of serious flaws in OpenAI's Codex ecosystem. Together they show an industry adopting agentic infrastructure before it has a reliable way to vet it.

What the NSA is telling defenders

The NSA's guidance treats MCP as a high-risk execution surface, not a convenient integration layer. It uses CVE-2025-49596 as a case study. That vulnerability affected MCP-Inspector, a tool developers use to test MCP servers under development, and stemmed from the inspector accepting unverified inputs 2. The lesson the agency draws is that the tools used to build MCP infrastructure can themselves be attack vectors.

The agency's recommendations are familiar from other areas of systems hardening:

• Validate inputs. Check for malformed inputs, missing fields and excessive sizes, any of which could destabilize a system or enable prompt injection and denial-of-service techniques 2.
• Limit parameter forwarding. Block or restrict it when data may be user-supplied, so inputs meant for one component aren't reused by another and cause cascading failures or data leakage 2.
• Sandbox tool execution. Isolate each tool call using mechanisms such as seccomp, AppArmor or SELinux, so a compromise can't spread laterally or escalate privileges 2.
• Apply least privilege to agents. MCP agent processes themselves should run with only the permissions they need 2.

None of this is novel. Its significance is that a major intelligence agency now counts MCP among the systems that need deliberate, defense-in-depth engineering.

What scanners actually catch

If the NSA describes what defenders should do, an April 2026 audit from AppSec Santa tests whether current tooling can help. The researcher ran two open-source scanners against 33 MCP servers: Cisco's mcp-scanner v4.3.0, which applies YARA pattern matching to tool descriptions and schemas, and Invariant Labs' MCP-Scan v0.4.3, which focuses on configuration-level issues 1. The audit described these as the only two open-source options available at the time 1.

Across 433 discovered tools, the YARA-based scanner flagged 27 patterns in 10 servers 1. The researcher cautioned that the figure sounds more alarming than it is, pointing to the difference between a pattern match and a confirmed vulnerability 1. Pattern matching on natural-language tool descriptions tends to produce noise. A tool that legitimately mentions file deletion or credential handling can look identical to a malicious one. The two scanners also take different approaches, which suggests neither gives complete coverage alone 1.

This matters in practice. A scanner that floods teams with questionable alerts can teach them to ignore its output. That leaves organizations stuck between unreliable automated triage and manual review that doesn't scale as MCP servers multiply.

The threat is already real

The Codex incidents show these risks are not theoretical. According to CSO Online, a critical command-injection flaw in Codex, CVE-2025-61260 (CVSS 9.8), allowed silent remote code execution through malicious project-local MCP configuration files 3. Separately, a malicious npm package stole Codex authentication tokens from an estimated 27,000 to 29,000 downloads before OpenAI patched the issue 3.

OpenAI's own documentation also warns that connecting ChatGPT's developer-mode MCP support to untrusted servers could enable prompt-injection-driven data exfiltration and destructive write actions 3. Security researchers have called the feature "powerful but dangerous" 3. CSO Online frames this as a counterpoint to the productivity message around agentic coding, arguing that enterprise rollout is outpacing the tools needed to vet MCP servers, tool permissions and the growing number of tokens agents hold 3.

Reading the signals together

The three accounts agree on the core problem. They differ in focus: the NSA addresses architecture, the audit addresses detection, and the Codex reporting addresses exploitation in the wild.

The practical conclusion is that organizations shouldn't treat scanners as a gatekeeper for MCP adoption. Current tools appear useful for flagging items to review, but they can't tell a dangerous capability from a benign one with much confidence. The NSA's emphasis on sandboxing and least privilege is the more durable defense, because it limits damage even when detection fails. The Codex config-file flaw is a clear example: a protection that assumes a malicious server will be caught beforehand fails when the attack comes through a trusted project's own configuration.

Until scanning matures, the safest stance is containment. Assume any MCP tool might be hostile, and design so that it can't do much harm if it is.