MCP has no per-message authentication or integrity verification layer

[razashariff]

Summary

MCP provides a powerful tool-calling protocol for AI agents, but it has no cryptographic identity or message integrity layer. There is no mechanism to verify which agent issued a request, whether a tool definition has been tampered with, or whether a message is a replay.

This is a protocol-level gap that affects all MCP adopters and implementations.

The gap

• No agent identity: Any client connecting over MCP can call any tool. There is no passport or certificate mechanism.
• No message signing: JSON-RPC messages are sent unsigned. Parameters can be modified in transit.
• No tool integrity: Tool definitions (tools/list) are not signed by their author. Tool poisoning (OWASP MCP03) allows an attacker to modify tool descriptions to change agent behavior.
• No replay protection: The same message can be replayed indefinitely. No nonce, no timestamp window.

OWASP has published an MCP Top 10 covering these risks. CVEs with CVSS 9.6 have been filed against MCP implementations.

Existing work

An IETF Internet-Draft has been published to address this at the protocol level:

• IETF Datatracker: https://datatracker.ietf.org/doc/draft-sharif-mcps-secure-mcp/
• Reference implementations: npm / PyPI (zero dependencies)
• Interactive demo: https://agentsign.dev/playground

The spec (MCPS) adds agent passports (ECDSA P-256), per-message signing, tool definition signatures, and nonce-based replay protection as an envelope around existing JSON-RPC -- fully backward-compatible with current MCP.

Happy to discuss technical details or integration approaches.

[razashariff]

Update: Real-world MCP security incidents now documented

Since filing this issue, multiple real-world MCP security incidents have been publicly disclosed:

• CVE-2025-6514 (CVSS 9.6) -- mcp-remote RCE via crafted OAuth URL. 437,000+ downloads affected.
• CVE-2025-49596 (CVSS 9.4) -- Anthropic MCP Inspector unauthenticated RCE. 38,000 weekly downloads.
• CVE-2025-68145/68143/68144 -- Anthropic mcp-server-git chain. Full RCE via path bypass + git_init + argument injection.
• Smithery.ai breach -- Path traversal exposed 3,243 MCP servers and thousands of API keys.
• Asana cross-tenant leak -- MCP server bug exposed ~1,000 customers' data across organisations for 34 days.
• postmark-mcp backdoor -- First malicious MCP server in the wild. BCC'd every email to attacker.

The full specification for addressing these at the protocol level is now an IETF Internet-Draft:
https://datatracker.ietf.org/doc/draft-sharif-mcps-secure-mcp/

Interactive playground (no install): https://agentsign.dev/playground