{
  "schema": "lri.mcp-threat-matrix/v1",
  "updated_at": "2026-07-23",
  "source": "official MCP Security Best Practices",
  "risks": [
    {
      "id": "M1",
      "risk": "Confused deputy",
      "mechanism": "MCP proxy and third-party OAuth consent can be mixed across client identities",
      "required_controls": [
        "per-client consent",
        "exact redirect URI validation",
        "single-use OAuth state",
        "CSRF and clickjacking protections"
      ],
      "evidence_ref": "mcp_security_best_practices"
    },
    {
      "id": "M2",
      "risk": "Token passthrough",
      "mechanism": "server forwards tokens not issued for itself and loses audience, control and audit boundaries",
      "required_controls": [
        "reject foreign-audience tokens",
        "validate issuer/audience/scopes",
        "use token exchange or delegated authorization",
        "short-lived credentials"
      ],
      "evidence_ref": "mcp_security_best_practices"
    },
    {
      "id": "M3",
      "risk": "OAuth metadata SSRF",
      "mechanism": "malicious metadata URLs redirect discovery toward internal, loopback or cloud-metadata services",
      "required_controls": [
        "HTTPS",
        "private/reserved IP blocking",
        "redirect validation",
        "egress proxy",
        "DNS rebinding defenses"
      ],
      "evidence_ref": "mcp_security_best_practices"
    },
    {
      "id": "M4",
      "risk": "Session hijacking and event injection",
      "mechanism": "stolen or cross-user session IDs allow impersonation or malicious async events",
      "required_controls": [
        "authenticate every request",
        "do not use sessions as authentication",
        "secure random IDs",
        "bind sessions to user identity",
        "rotation and expiry"
      ],
      "evidence_ref": "mcp_security_best_practices"
    },
    {
      "id": "M5",
      "risk": "Local MCP server compromise",
      "mechanism": "one-click startup commands or untrusted binaries inherit client privileges and host access",
      "required_controls": [
        "show exact command and require consent",
        "sandbox by default",
        "restrict file/network access",
        "prefer stdio or protected IPC",
        "publisher and artifact provenance"
      ],
      "evidence_ref": "mcp_security_best_practices"
    },
    {
      "id": "M6",
      "risk": "Scope inflation",
      "mechanism": "wildcard or omnibus scopes expand blast radius and obscure per-operation intent",
      "required_controls": [
        "minimal initial scopes",
        "progressive elevation",
        "precise challenges",
        "down-scoping tolerance",
        "elevation telemetry"
      ],
      "evidence_ref": "mcp_security_best_practices"
    }
  ]
}