Blog
MCP security blog
The NoFly MCP security blog covers what security and platform teams need to know about AI agents and the MCP servers they load: where they hide, how real attacks worked, and what to check before anything runs.
Guides to MCP server and AI agent security
-
November 4, 2026
How to find MCP servers on developer machines
Every coding agent keeps its MCP servers in a config file. Here is where to find MCP servers on developer machines for each agent, and what to record when you do.
-
November 4, 2026
What a malicious MCP server looks like: real cases and the warning signs
A malicious MCP server has already been caught copying email in the wild. Four documented cases show how these attacks work and what gives them away.
-
November 4, 2026
MCP security checklist: 12 checks before an agent loads a server
This MCP security checklist covers the 12 checks to run before any AI agent loads an MCP server, each tied to the OWASP MCP Top 10 or the MCP specification.
-
November 4, 2026
MCP server security risks: the six groups and the real cases behind them
MCP server security risks fall into six groups. This overview explains each with a documented case, its OWASP MCP Top 10 entry and the fix the MCP spec sets out.
-
November 4, 2026
The OWASP MCP Top 10, explained in plain English
The OWASP MCP Top 10 lists the ten biggest security risks in MCP servers and AI agents. Here is each one in plain English, with a real example and a fix.
-
November 4, 2026
MCP tool poisoning attack: how it works and how to spot one
An MCP tool poisoning attack hides instructions where only the AI model looks. Here is how it works, what the research showed, and how to catch one.
-
November 4, 2026
How to find shadow AI in your organization
Six places to look when you need to find shadow AI in your organization, from SSO grants to the coding agents and MCP servers most reviews never check.
-
November 4, 2026
Shadow AI detection tools: what each category finds and misses
Shadow AI detection tools each watch one layer. Here is what network, browser, SaaS, data and agent discovery tools see, and where each one is blind.
-
November 4, 2026
Claude Code security risks: what the agent can reach and how to control it
Claude Code security risks come from what the agent can touch: files, shell, network and MCP servers. Here are the documented cases and the controls that limit each one.
-
November 4, 2026
Cursor security risks: what the 2025 vulnerabilities show and how to lock Cursor down
Cursor security risks range from repositories that run code on open to MCP servers that change after approval. Each documented case, and the controls Cursor offers.
-
November 4, 2026
GitHub Copilot security risks: what changed with agent mode and MCP
GitHub Copilot security risks grew when Copilot became an agent. Here is each risk, the real cases behind it, and where the documented controls stop.
-
November 4, 2026
How to secure MCP servers: a guide for the teams that build and run them
How to secure MCP servers from the builder side: the seven decisions that close the gaps attackers use, each tied to the MCP spec or OWASP guidance.
-
November 4, 2026
MCP server authentication: what the spec requires and where servers go wrong
MCP server authentication has one rule set for remote servers and another for local ones. Here is what the MCP authorization spec requires and the common mistakes.
-
November 4, 2026
MCP server logging best practices: what to record, where, and what to leave out
MCP server logging best practices in five rules, from what each tool call record needs to why stdout is off limits and what never belongs in a log.
-
November 4, 2026
MCP prompt injection: how content from tools takes over an agent
MCP prompt injection turns the data an agent reads into orders it follows. Two documented cases show how it works, and which defenses limit the damage.
-
November 4, 2026
Shadow MCP servers: what they are, why they spread, and how to find them
Shadow MCP servers are the ones security does not know about. Here is why they spread so fast and how to find them on laptops, in repos and in the cloud.
-
November 4, 2026
How to set an MCP allowlist in Claude Code, Cursor and GitHub Copilot
An MCP allowlist limits AI agents to servers you approved. Here is how each major coding agent implements one, how matching works, and the gaps to plan for.
-
November 4, 2026
The OWASP agentic AI top 10, explained with real cases
The OWASP agentic AI top 10 names the ten biggest risks in AI agents. Here is each one in plain English, with the real case behind it and what to do first.
-
November 4, 2026
Vibe coding security risks: what has gone wrong and how to ship safely
Vibe coding security risks come from code that ships without anyone reading it. The research, the real incidents, and a short checklist before you go live.
-
November 4, 2026
AI acceptable use policy template, including AI agents and MCP servers
A practical AI acceptable use policy template you can copy, with the section most policies miss: AI agents and the MCP servers they connect to.
-
November 4, 2026
Claude Code dangerously skip permissions: what the flag does and safer options
Claude Code dangerously skip permissions turns off every prompt. Here is what the flag disables, where Anthropic says it belongs, and how to get speed without it.
-
November 4, 2026
mcp.json example: safer configs for Claude Code, Cursor and VS Code
A risky mcp.json example next to a safer one for each tool, with every key checked against the vendor docs: pinned versions, scoped paths, no secrets in the file.
-
November 4, 2026
Windsurf security concerns: what the research found and the settings that help
Windsurf security concerns center on tools that act without asking. Here is the published research, how session modes work, and the admin controls that help.
New to the terms? Start with the AI agent security glossary, or check a server right now on the NoFly list.