bitsalt

The MCP Security Threat Model

A complete framework for understanding the attack surface of MCP-enabled AI agents in developer environments

What's included

  • 8 threat categories with attack scenarios and mitigations
  • Severity ratings and real-world examples from early 2026 incidents
  • A security checklist for MCP deployments
  • Framework for ongoing governance (not just point-in-time fixes)
  • Reference architecture for secure MCP deployment

This document is the compiled version of the 8-part blog series, with additional detail, structured checklists, and a reference architecture. The individual posts are free — this is the reference document.

The blog series is in progress. Posts are published as they're ready. The compiled document will be available when the series is complete. Follow along in the meantime →

Get the Threat Model

Enter your email and we'll send it when it's ready. You'll also get each new post as it's published.