The State of MCP 2026

Tool poisoning is an indirect prompt injection attack in which instructions are hidden inside tool metadata or responses. Descriptions enter the agent's context window as trusted content; an attacker who controls one can embed instructions the model reads and acts on. Invariant Labs demonstrated the class in April 2025; OWASP now documents it as a named pattern. What distinguishes it from classic prompt injection is persistence — a poisoned description fires on every invocation, for every user, silently, until someone notices.

The 2026 incident record reads like the npm ecosystem's early years replayed at higher speed: registry poisoning against agent skill marketplaces, malicious configuration files, and a disclosure exposing up to 200,000 vulnerable MCP instances — including a CVSS 9.6 remote code execution flaw in a package downloaded nearly half a million times.

BlueRock Security found 36.7% of 7,000+ servers potentially vulnerable to SSRF; in one proof of concept, researchers retrieved AWS IAM credentials from an EC2 metadata endpoint. Combined with Endor Labs' finding that 82% of implementations use traversal-prone file operations, the pattern is clear: most public MCP servers were written as integrations, not as the security-sensitive network services they actually are.

The defensive market has organized into three complementary layers: network allowlists and control-plane tools that restrict where agents can reach; MCP gateways that centralize routing, policy and authentication; and inspection/runtime scanners that analyze server code, tool metadata and live behavior. No single layer is sufficient — defense in depth is what limits blast radius.

NIST launched its AI Agent Standards Initiative in February 2026, with an interoperability profile expected in Q4 2026. Until then, the OWASP MCP Top 10 and the protocol's own OAuth 2.1 requirements are the closest things to a baseline. Organizations deploying MCP today should treat agents as privileged identities.

codelake approaches MCP security from the supply chain inward: mcpscanner performs static and metadata analysis before a server reaches an agent; PromptGate enforces policy at runtime. codelake Research operates a continuous registry-monitoring pipeline with multi-stage verification, publishing advisories under the CLR-YYYY-NNNN scheme in OSV-compatible format.

We expect the official MCP Registry to consolidate as the canonical index while community registries differentiate on curation. The gateway pattern will become the default enterprise topology, driven equally by the context-tax problem and by audit requirements.

On the threat side, we expect registry poisoning campaigns to grow in sophistication, following the trajectory npm and PyPI established — and we expect the first widely reported enterprise breach with an MCP server as initial access vector within the next twelve months.

The NIST interoperability profile and a maturing OWASP MCP Top 10 will give buyers their first real compliance anchors; we anticipate MCP security requirements appearing in enterprise procurement checklists by early 2027.