MCP Security Shift: Endpoint Enforcement is Key

The Model Context Protocol (MCP) saw its most significant revision ship on July 28, with immediate adoption by major SDKs and customers. This update introduces a stateless core, OAuth-native authorization, and server-rendered UIs, but more critically, it fundamentally shifts security enforcement from the protocol to individual endpoints. Platform teams must evolve their security architecture to address new attack surfaces.

Three primary new attack vectors have emerged: stored XSS within MCP Apps, handle hijacking facilitated by prompt injection, and the persistent invisibility of network enforcement gaps as state moves to the application layer. These threats require per-request validation and endpoint visibility, as network-layer tools may no longer suffice.

The protocol's version 12-month deprecation policy ensures these changes remain in effect through at least mid-2027. To mitigate risks, organizations should identify MCP servers rendering UI, enforce security at the request level, treat handles as untrusted input, and instrument endpoints for greater visibility.

This evolution of MCP necessitates a strategic security transition, moving enforcement to the request level and implementing controls at the endpoint. Companies that treat this as a security upgrade, rather than just a migration, will better withstand emerging threats.