Untrusted MCP servers as software supply-chain dependencies addresses one concrete problem: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. The guide works from the actual objects — MCP server, supply chain, tool schema, credential, approval — and aims for a verifiable decision rather than a generic pattern.
The concrete problem: MCP server meets supply chain
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c11 starts at MCP server and treats supply chain as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before credential can trigger the intended effect around approval. If the credential verification fails, rollback restores the configuration around approval, replays untrusted-mcp-server-supply-chain-c11, and compares the new state with the control evidence from MCP server. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to supply chain, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool schema and approval: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c11 is labeled as a limitation or inference, never promoted to fact.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c12 starts at supply chain and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires credential to emit an observable result before approval can trigger the intended effect around MCP server. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns supply chain into a reviewable decision point with a named input and a retained output. To test tool schema, fixture untrusted-mcp-server-supply-chain-c12 contains both an allowed state and a rejected state; rejection must occur before any change attributed to credential. Operations then observes the transition between credential and approval, while security checks that MCP server receives neither implicit authority nor unnecessary data.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c13 starts at tool schema and treats credential as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before MCP server can trigger the intended effect around supply chain. If the MCP server verification fails, rollback restores the configuration around supply chain, replays untrusted-mcp-server-supply-chain-c13, and compares the new state with the control evidence from tool schema. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to credential, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by approval and supply chain: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c13 is labeled as a limitation or inference, never promoted to fact.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c14 starts at credential and treats approval as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before supply chain can trigger the intended effect around tool schema. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns credential into a reviewable decision point with a named input and a retained output. To test approval, fixture untrusted-mcp-server-supply-chain-c14 contains both an allowed state and a rejected state; rejection must occur before any change attributed to MCP server. Operations then observes the transition between MCP server and supply chain, while security checks that tool schema receives neither implicit authority nor unnecessary data.
Failure modes, signals, and diagnosis
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c21 starts at supply chain and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires credential to emit an observable result before approval can trigger the intended effect around MCP server. Operations then observes the transition between credential and approval, while security checks that MCP server receives neither implicit authority nor unnecessary data. If the approval verification fails, rollback restores the configuration around MCP server, replays untrusted-mcp-server-supply-chain-c21, and compares the new state with the control evidence from supply chain. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to tool schema, a concrete condition, and evidence instead of a generic assurance.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c22 starts at tool schema and treats credential as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before MCP server can trigger the intended effect around supply chain. The conclusion stays bounded by approval and supply chain: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c22 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns tool schema into a reviewable decision point with a named input and a retained output. To test credential, fixture untrusted-mcp-server-supply-chain-c22 contains both an allowed state and a rejected state; rejection must occur before any change attributed to approval.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c23 starts at credential and treats approval as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before supply chain can trigger the intended effect around tool schema. Operations then observes the transition between MCP server and supply chain, while security checks that tool schema receives neither implicit authority nor unnecessary data. If the supply chain verification fails, rollback restores the configuration around tool schema, replays untrusted-mcp-server-supply-chain-c23, and compares the new state with the control evidence from credential. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to approval, a concrete condition, and evidence instead of a generic assurance.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c24 starts at approval and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires supply chain to emit an observable result before tool schema can trigger the intended effect around credential. The conclusion stays bounded by supply chain and credential: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c24 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns approval into a reviewable decision point with a named input and a retained output. To test MCP server, fixture untrusted-mcp-server-supply-chain-c24 contains both an allowed state and a rejected state; rejection must occur before any change attributed to supply chain.
Progressive rollout and rollback
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c31 starts at tool schema and treats credential as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before MCP server can trigger the intended effect around supply chain. To test credential, fixture untrusted-mcp-server-supply-chain-c31 contains both an allowed state and a rejected state; rejection must occur before any change attributed to approval. Operations then observes the transition between approval and MCP server, while security checks that supply chain receives neither implicit authority nor unnecessary data. If the MCP server verification fails, rollback restores the configuration around supply chain, replays untrusted-mcp-server-supply-chain-c31, and compares the new state with the control evidence from tool schema.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c32 starts at credential and treats approval as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before supply chain can trigger the intended effect around tool schema. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to approval, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by MCP server and tool schema: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c32 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns credential into a reviewable decision point with a named input and a retained output.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c33 starts at approval and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires supply chain to emit an observable result before tool schema can trigger the intended effect around credential. To test MCP server, fixture untrusted-mcp-server-supply-chain-c33 contains both an allowed state and a rejected state; rejection must occur before any change attributed to supply chain. Operations then observes the transition between supply chain and tool schema, while security checks that credential receives neither implicit authority nor unnecessary data. If the tool schema verification fails, rollback restores the configuration around credential, replays untrusted-mcp-server-supply-chain-c33, and compares the new state with the control evidence from approval.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c34 starts at MCP server and treats supply chain as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before credential can trigger the intended effect around approval. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to supply chain, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool schema and approval: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c34 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns MCP server into a reviewable decision point with a named input and a retained output.
Production decision criteria
The starting point is not a feature; it is an observable decision boundary.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c41 starts at credential and treats approval as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before supply chain can trigger the intended effect around tool schema. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns credential into a reviewable decision point with a named input and a retained output. To test approval, fixture untrusted-mcp-server-supply-chain-c41 contains both an allowed state and a rejected state; rejection must occur before any change attributed to MCP server. Operations then observes the transition between MCP server and supply chain, while security checks that tool schema receives neither implicit authority nor unnecessary data.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c42 starts at approval and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires supply chain to emit an observable result before tool schema can trigger the intended effect around credential. If the tool schema verification fails, rollback restores the configuration around credential, replays untrusted-mcp-server-supply-chain-c42, and compares the new state with the control evidence from approval. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to MCP server, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by supply chain and credential: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c42 is labeled as a limitation or inference, never promoted to fact.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c43 starts at MCP server and treats supply chain as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before credential can trigger the intended effect around approval. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns MCP server into a reviewable decision point with a named input and a retained output. To test supply chain, fixture untrusted-mcp-server-supply-chain-c43 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool schema. Operations then observes the transition between tool schema and credential, while security checks that approval receives neither implicit authority nor unnecessary data.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c44 starts at supply chain and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires credential to emit an observable result before approval can trigger the intended effect around MCP server. If the approval verification fails, rollback restores the configuration around MCP server, replays untrusted-mcp-server-supply-chain-c44, and compares the new state with the control evidence from supply chain. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to tool schema, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by credential and MCP server: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c44 is labeled as a limitation or inference, never promoted to fact.
Trust boundaries around tool schema
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c51 starts at approval and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires supply chain to emit an observable result before tool schema can trigger the intended effect around credential. The conclusion stays bounded by supply chain and credential: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c51 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns approval into a reviewable decision point with a named input and a retained output. To test MCP server, fixture untrusted-mcp-server-supply-chain-c51 contains both an allowed state and a rejected state; rejection must occur before any change attributed to supply chain.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c52 starts at MCP server and treats supply chain as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before credential can trigger the intended effect around approval. Operations then observes the transition between tool schema and credential, while security checks that approval receives neither implicit authority nor unnecessary data. If the credential verification fails, rollback restores the configuration around approval, replays untrusted-mcp-server-supply-chain-c52, and compares the new state with the control evidence from MCP server. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to supply chain, a concrete condition, and evidence instead of a generic assurance.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c53 starts at supply chain and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires credential to emit an observable result before approval can trigger the intended effect around MCP server. The conclusion stays bounded by credential and MCP server: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c53 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns supply chain into a reviewable decision point with a named input and a retained output. To test tool schema, fixture untrusted-mcp-server-supply-chain-c53 contains both an allowed state and a rejected state; rejection must occur before any change attributed to credential.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c54 starts at tool schema and treats credential as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before MCP server can trigger the intended effect around supply chain. Operations then observes the transition between approval and MCP server, while security checks that supply chain receives neither implicit authority nor unnecessary data. If the MCP server verification fails, rollback restores the configuration around supply chain, replays untrusted-mcp-server-supply-chain-c54, and compares the new state with the control evidence from tool schema. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to credential, a concrete condition, and evidence instead of a generic assurance.
Build the decision path with credential
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c61 starts at MCP server and treats supply chain as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before credential can trigger the intended effect around approval. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to supply chain, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool schema and approval: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c61 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns MCP server into a reviewable decision point with a named input and a retained output.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c62 starts at supply chain and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires credential to emit an observable result before approval can trigger the intended effect around MCP server. To test tool schema, fixture untrusted-mcp-server-supply-chain-c62 contains both an allowed state and a rejected state; rejection must occur before any change attributed to credential. Operations then observes the transition between credential and approval, while security checks that MCP server receives neither implicit authority nor unnecessary data. If the approval verification fails, rollback restores the configuration around MCP server, replays untrusted-mcp-server-supply-chain-c62, and compares the new state with the control evidence from supply chain.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c63 starts at tool schema and treats credential as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before MCP server can trigger the intended effect around supply chain. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to credential, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by approval and supply chain: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c63 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns tool schema into a reviewable decision point with a named input and a retained output.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c64 starts at credential and treats approval as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before supply chain can trigger the intended effect around tool schema. To test approval, fixture untrusted-mcp-server-supply-chain-c64 contains both an allowed state and a rejected state; rejection must occur before any change attributed to MCP server. Operations then observes the transition between MCP server and supply chain, while security checks that tool schema receives neither implicit authority nor unnecessary data. If the supply chain verification fails, rollback restores the configuration around tool schema, replays untrusted-mcp-server-supply-chain-c64, and compares the new state with the control evidence from credential.
Verify approval with observable evidence
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c71 starts at supply chain and treats tool schema as an explicit boundary rather than an implicit assumption. The first control requires credential to emit an observable result before approval can trigger the intended effect around MCP server. If the approval verification fails, rollback restores the configuration around MCP server, replays untrusted-mcp-server-supply-chain-c71, and compares the new state with the control evidence from supply chain. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to tool schema, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by credential and MCP server: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c71 is labeled as a limitation or inference, never promoted to fact.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c72 starts at tool schema and treats credential as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before MCP server can trigger the intended effect around supply chain. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns tool schema into a reviewable decision point with a named input and a retained output. To test credential, fixture untrusted-mcp-server-supply-chain-c72 contains both an allowed state and a rejected state; rejection must occur before any change attributed to approval. Operations then observes the transition between approval and MCP server, while security checks that supply chain receives neither implicit authority nor unnecessary data.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c73 starts at credential and treats approval as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before supply chain can trigger the intended effect around tool schema. If the supply chain verification fails, rollback restores the configuration around tool schema, replays untrusted-mcp-server-supply-chain-c73, and compares the new state with the control evidence from credential. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to approval, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by MCP server and tool schema: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c73 is labeled as a limitation or inference, never promoted to fact.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c74 starts at approval and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires supply chain to emit an observable result before tool schema can trigger the intended effect around credential. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns approval into a reviewable decision point with a named input and a retained output. To test MCP server, fixture untrusted-mcp-server-supply-chain-c74 contains both an allowed state and a rejected state; rejection must occur before any change attributed to supply chain. Operations then observes the transition between supply chain and tool schema, while security checks that credential receives neither implicit authority nor unnecessary data.
Evidence point: NIST documents that nIST positions the AI RMF as a voluntary framework for managing AI risks and is revising it while adding profiles for specific settings. This source anchors verify approval with observable evidence but does not replace local verification. [S7]Controls that remain after launch
The starting point is not a feature; it is an observable decision boundary.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c81 starts at tool schema and treats credential as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before MCP server can trigger the intended effect around supply chain. Operations then observes the transition between approval and MCP server, while security checks that supply chain receives neither implicit authority nor unnecessary data. If the MCP server verification fails, rollback restores the configuration around supply chain, replays untrusted-mcp-server-supply-chain-c81, and compares the new state with the control evidence from tool schema. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to credential, a concrete condition, and evidence instead of a generic assurance.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c82 starts at credential and treats approval as an explicit boundary rather than an implicit assumption. The first control requires MCP server to emit an observable result before supply chain can trigger the intended effect around tool schema. The conclusion stays bounded by MCP server and tool schema: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c82 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns credential into a reviewable decision point with a named input and a retained output. To test approval, fixture untrusted-mcp-server-supply-chain-c82 contains both an allowed state and a rejected state; rejection must occur before any change attributed to MCP server.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c83 starts at approval and treats MCP server as an explicit boundary rather than an implicit assumption. The first control requires supply chain to emit an observable result before tool schema can trigger the intended effect around credential. Operations then observes the transition between supply chain and tool schema, while security checks that credential receives neither implicit authority nor unnecessary data. If the tool schema verification fails, rollback restores the configuration around credential, replays untrusted-mcp-server-supply-chain-c83, and compares the new state with the control evidence from approval. This detail makes “Untrusted MCP servers as software supply-chain dependencies” reviewable because each operational statement points to MCP server, a concrete condition, and evidence instead of a generic assurance.
In “Untrusted MCP servers as software supply-chain dependencies”, scenario untrusted-mcp-server-supply-chain-c84 starts at MCP server and treats supply chain as an explicit boundary rather than an implicit assumption. The first control requires tool schema to emit an observable result before credential can trigger the intended effect around approval. The conclusion stays bounded by tool schema and approval: anything not demonstrated by scenario untrusted-mcp-server-supply-chain-c84 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Treat an MCP server as executable dependency and credential-bearing integration rather than a harmless tool catalog. It turns MCP server into a reviewable decision point with a named input and a retained output. To test supply chain, fixture untrusted-mcp-server-supply-chain-c84 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool schema.
Evidence point: OWASP documents that oWASP identifies its 2026 LLM Top 10 as the current release for major security risks in LLM applications. This source anchors controls that remain after launch but does not replace local verification. [S8]Operational checklist
- The control around MCP server has an input, a rule, a rejection behavior, and evidence.
- The control around supply chain has an input, a rule, a rejection behavior, and evidence.
- The control around tool schema has an input, a rule, a rejection behavior, and evidence.
- The control around credential has an input, a rule, a rejection behavior, and evidence.
- The control around approval has an input, a rule, a rejection behavior, and evidence.
Sources and control points
- [S1] SLSA specification v1.2 — SLSA 1.2 organizes supply-chain assurances into tracks and levels with recommended attestation formats. source
- [S2] SLSA Provenance — SLSA provenance is verifiable information linking a software artifact to how, when and from what it was produced. source
- [S3] SLSA Build Track Basics — SLSA build levels progress from no guarantees to provenance, hosted signed builds and hardened build platforms. source
- [S4] Build attestations - Docker Docs — Docker BuildKit can attach SBOM and provenance attestations so consumers can inspect image contents and build origin. source
- [S5] SBOM attestations - Docker Docs — Docker can generate SPDX SBOM attestations during BuildKit builds and provides local inspection workflows. source
- [S6] Artificial Intelligence Risk Management Framework: Generative AI Profile — NIST AI 600-1 is a generative-AI profile for integrating trustworthiness and risk actions across the AI lifecycle. source
- [S7] AI Risk Management Framework — NIST positions the AI RMF as a voluntary framework for managing AI risks and is revising it while adding profiles for specific settings. source
- [S8] OWASP Top 10 for Large Language Model Applications — OWASP identifies its 2026 LLM Top 10 as the current release for major security risks in LLM applications. source
- [S9] OWASP Top 10 for LLM Applications 2025 — The 2025 OWASP LLM list provides the prior baseline for risks observed as LLMs became embedded in more production applications. source
- [S10] Reviewing dependency changes in a pull request — Dependency review exposes added, removed and updated dependencies together with vulnerability context before changes are merged. source
Comments
No published comment yet.
Sign in to comment