MCP news & analysis
What is happening in the MCP ecosystem, explained for business: spec changes, new official servers, security incidents and regulation. Every article cites its sources.
AWS patches its own MCP servers and agent tools: API MCP Server accepted tokens meant for other apps
In October 2026 AWS published five security bulletins for its MCP servers and Strands agent tooling. The key one: in OAuth mode, the AWS API MCP Server accepted tokens issued to a different application. Upgrade to 1.6.0 and set the audience.
Read more →
MCP Inspector: nine security advisories, two critical — testing an untrusted server could take over your laptop
On 21 October the MCP project published nine security advisories for its testing tool, MCP Inspector. Two critical flaws let a malicious remote server run commands on the developer's laptop through the OAuth step. Update to 2.12.0 or 1.0.3.
Read more →
Agent Skills joins the Agentic AI Foundation: MCP gets a neutral sibling for know-how and workflows
At MCPCon in San Jose (22 October), the Agentic AI Foundation added four new projects, including Anthropic's Agent Skills. Access (MCP) and codified workflows (skills) now sit under the same neutral governance.
Read more →
Official MCP reference servers reach 2.0: fetch now blocks internal addresses, and that may affect your setup
The MCP project released v1.0.0 and v2.0.0 of its reference servers on 11 and 19 October. The fetch server now refuses internal and cloud metadata addresses by default, fixing CVE-2026-104120. That closes a hole, but can also break existing workflows.
Read more →
Langflow MCP flaw under active exploitation: why the 'command' field in an MCP configuration is executable code
Since 19 September attackers have been exploiting a Langflow flaw where the command field of an MCP server configuration runs as a shell command. On 15 October JetBrains published a CVE for the same pattern in Junie CLI. Whoever may add an MCP server may execute code.
Read more →
Ten security advisories for the official MCP SDKs: which update you need now (and which does nothing without configuration)
Between 28 September and 5 October the MCP project published ten security advisories for its official Python and TypeScript SDKs. The most serious: a malicious MCP server could redirect OAuth secrets. Two fixes only work after a configuration change.
Read more →
One SSRF pattern in MCP servers from Google, JPMorgan and governments: what 'protocol pivoting' means
An independent researcher found the same flaw in MCP servers from Google, JPMorgan, the French government and others: URLs coming from the agent are followed blindly. Google's MCP Toolbox received CVE-2026-14540 (CVSS 8.0).
Read more →
MCP Events in ChatGPT: your AI assistant now reacts on its own to what happens in your systems
Since DevDay, an MCP server can wake ChatGPT up when something happens. Useful for automation — but it is a draft specification, and a subscription turns out to be a long-lived credential.
Read more →
29 CVEs for mcp-atlassian: what Jira and Confluence users should do now
The most popular community MCP server for Jira and Confluence received 29 CVE IDs in a single day. The fixes have been out since July — but not everyone has them, and the latest critical flaw only arrived in August.
Read more →
MCP endpoint of AI gateway LiteLLM lands on CISA's actively exploited list
A fabricated Authorization header was enough to get in through LiteLLM's MCP endpoint. CISA has confirmed active exploitation — and that changes how you should look at your AI gateway.
Read more →
New MCP specification makes the protocol stateless: what it means for your organisation
The biggest revision since MCP was created: a stateless core, hardened authorization and a formal extensions framework. What your organisation needs to know — and what is not urgent.
Read more →