MODEL CONTEXT PROTOCOL (MCP) AND SUPPLY-CHAIN SECURITY

STATIC APPLICATION SECURITY TESTING SAST means automated scanning of source code for security flaws without running the code. Think of a spell checker for security. It reads the code and flags suspicious patterns, such as user input being placed straight into a command that runs on the computer, which is called command injection. SAST catches many ordinary coding flaws before deployment. It has limits. Malicious wording hidden in a tool description is not a code flaw, so scanners that read only code can miss it. That is why SAST is combined with review of tool descriptions, as in Chapter 38, and with testing in a sandbox, as in Chapter 40. VERIFYING SERVER INTEGRITY AND SCANNING PACKAGES Integrity means that something has not been altered. A checksum or hash is a short fingerprint calculated from a file. If even one character of the file changes, the fingerprint changes. By comparing the fingerprint with a published trusted one, you can confirm the file is unaltered. Before installing a server package, teams also scan its dependencies, the other packages it needs, against lists of known vulnerabilities and known malware. They prefer well-maintained projects with named owners and visible review history. They keep a record of every server in use, because an unknown or unapproved server, sometimes called a shadow server, is a hidden risk.