MODEL CONTEXT PROTOCOL (MCP) AND SUPPLY-CHAIN SECURITY

EXAMPLES Example 1: A supply-chain risk A team wants to connect to a popular third-party MCP server it found in a public list. Before connecting, it checks who maintains the server, reads its tool descriptions, scans its code and dependencies, and tests it in a sandbox. It finds nothing alarming and approves one pinned version. Example 2: Origin authentication An agent must talk to the official internal database server. The harness checks the server's signature and expected address before trusting any of its tools. An impersonator on a different address is rejected. Example 3: A SAST finding Before deploying a new server, an automated scanner flags a line that writes user input directly into a shell command without cleaning it. The developer changes the code to pass the input as a safe argument, and the flaw never reaches production. Example 4: Linking prompts to actions A security dashboard shows that one message pattern is often followed by a call to a sensitive file tool. The team investigates and finds an attacker practicing injection phrases, and they add a block. PRACTICE LAB CONNECTION Run a SAST-style review on the Resume Review Agent lab's MCP server integration from Chapter 67. Test the prompts below against it.