Research, TTPs, and engineering-grade writeups.

The Model Context Protocol (MCP) has become the plug-and-play interface between LLMs and the tools they need — filesystems, databases, Jira, GitHub, your CRM. In six months it went from "interesting spec" to "how every agent framework ships tools." It also went from "clean abstraction" to the largest underappreciated supply-chain surface in your stack. Every MCP server your agent connects to is a trust boundary crossing. Most of them came from a third party's GitHub. Most of them run with the agent's full credentials. Very few of them have been audited. ## The trust model you didn't write When an agent connects to an MCP server, it: - Trusts the server's **capability declaration** (what tools it says it provides). - Trusts the **tool output** returned to the model — that content re-enters the agent's context as authoritative. - Shares **credentials or session state** with the server, either explicitly (API keys) or implicitly (workspace access, network reachability). Any of those trust edges, violated, breaks the agent.