MCP Server Security Standard (MSSS)

[![CC BY-SA 4.0][cc-by-sa-shield]][cc-by-sa]

About MSSS

The Model Context Protocol enables AI models to interact with external systems through tools, resources, and prompts. As adoption accelerates, critical vulnerabilities have emerged: command injection, path traversal, SSRF attacks, and supply chain compromises.

MSSS provides:

• 24 security controls across 8 domains
• 4 compliance levels (L1-Essential, L2-Development, L3-Production, L4-Maximum Assurance)
• Risk-based level selection framework inspired by NIST CSF, OWASP ASVS, and CIS Controls
• 6 deployment profiles (Local Dev, Team Server, Internet-Facing, etc.)
• Evidence-based verification with clear acceptance criteria
• Machine-readable reporting through JSON schemas

Compliant Platforms

The following platforms have adopted the MCP Server Security Standard:

-	Platform	Description	Status
	MCP-Hub	MCP server directory and marketplace — discover, publish, and manage MCP-compliant servers	✅ Compliant

Are you implementing MSSS? Open an issue or submit a PR to be listed here.

Current Status - v0.1.0

Released: January 15, 2026 (Community Review Draft)

What's Included

• Core standard framework (msss.md)
• 6 deployment profiles defined
• Comprehensive threat model
• 23 fully documented security controls
• JSON reporting schemas
• i18n framework for translations

Areas for Community Contribution

• Implementation examples for common frameworks
• Automated verification tools
• Reference assessment reports
• Translations to other languages
• Real-world testing and feedback

Quick Start

For Implementers

1. Review deployment profiles to find your scenario
2. Implement controls from control catalog
3. Use reporting schemas for assessment
4. Share your experience via issues or discussions

For Contributors

# Fork and clone
git clone https://github.com/YOUR-USERNAME/mcp-server-security-standard
cd mcp-server-security-standard

# Start a translation
mkdir -p v0.1/i18n/es/standard

For Security Researchers

• Report vulnerabilities: security@mcp-security-standard.org
• Share attack patterns: Open an issue with threat-research label
• Propose new controls: See contributing guide

Compliance Levels

MSSS defines four compliance levels using a risk-based selection model (not maturity progression). Organizations select their target level based on deployment context, data sensitivity, and potential impact.

Level Selection Framework

Quick Decision Guide

Choose your level based on 4 key questions:

1. Who uses it? Individual → L1 | Team → L2 | Organization/Customers → L3 | Public/Regulated → L4
2. What data? Public → L1 | Internal → L2 | Business/PII → L3 | Regulated (PHI/PCI) → L4
3. Impact if compromised? Inconvenience → L1 | Dev delays → L2 | Disruption → L3

... View full README on GitHub