The NSA published 17 pages on MCP security. Here it is as a checklist you can run today

The NSA's Artificial Intelligence Security Center published a 17-page Cybersecurity Information Sheet on Model Context Protocol (MCP) security, and a developer has translated its themes into an actionable checklist for securing agent-to-tool connections. The guidance focuses on practical risks in the plumbing between models and tools, including inventorying MCP servers, pinning versions against supply chain incidents, guarding against poisoned tool descriptions that can steer agents into leaking data, preventing message replay and session reuse, enforcing least-privilege tool access, restricting server network reach, and maintaining audit logs of tool invocations.

For years, government AI guidance stayed at the level of "secure your AI systems" which is about as actionable as "drive carefully". In May that changed. The NSA Artificial Intelligence Security Center published a Cybersecurity Information Sheet on the Model Context Protocol specifically. Seventeen pages, public, aimed at people wiring agents to tools. That tells you something about where incidents are actually happening. Not in the model. In the plumbing between the model and your tools. I went through the public summaries and the sheet itself and pulled out the themes. Here is each one translated into a check you can run today. Most people cannot list their MCP servers without opening three config files. Check now: .mcp.json , claude desktop config.json , and similar config files If the list surprises you, that is the finding. Servers pulled with a floating tag change under you. When an MCP supply chain incident hits, pinned versions let you answer "am I affected" in seconds instead of guessing. This is the one Microsoft warned about in June: poisoned tool descriptions steering agents into leaking data through perfectly approved tool calls. The description field is text that influences your model. Your model reads it. So it is an input. The NSA sheet calls out message replay and unauthorized reuse of valid sessions. Practical version: A search tool does not need write access. A filesystem reader does not need the whole disk. An MCP server that can reach the entire internet can exfiltrate the entire context. Whitelist the domains it genuinely needs. If the server refuses to work behind an allowlist, ask yourself why. The sheet's guidance lands on auditability. Without a log of which tool ran with which arguments, every incident investigation starts with "we are not sure what the agent did". None of these are exotic. That is the point. The sheet exists because the boring layer is where the losses are. A scanner like the one I maintain catches a subset of this automatically. The rest is habits, and habits are what the checklist is for. I keep a 12 point preflight version of this for MCP setups. Drop a comment and I will send it over, free, no signup.