MODEL CONTEXT PROTOCOL (MCP) AND SUPPLY-CHAIN SECURITY

KEY TERMS REVIEW Supply chain: everything you rely on but did not build. Supply-chain attack: harm delivered through a compromised outside piece. Capability attestation: proof that a server does only what it claims. Origin authentication: proving where something came from. Pinning: locking to a specific reviewed version. SAST: scanning source code for flaws without running it. Command injection: user input placed into a command that runs. Hash: a fingerprint of a file used to confirm integrity. Shadow server: an unapproved server in use without being tracked. CHECK YOUR UNDERSTANDING • Why is connecting to a third-party server a supply-chain risk? ◦ Answer: You depend on code you did not write, which could be flawed or malicious. • What does origin authentication prevent? ◦ Answer: Impersonation, where a fake server pretends to be a trusted one. • What is SAST and what is one limit? ◦ Answer: Automated scanning of code for flaws, and it can miss malicious text in tool descriptions. • Why pin versions? ◦ Answer: To detect and prevent changes after approval, such as a rug pull. • Why link prompts to tool calls in monitoring? ◦ Answer: It reveals patterns, such as an attacker refining an injection.