Research · curated 23 Sep 2026

MCP Server Security: Field Notes — Leslie Kadenge

First reported today les-k.github.io

Coverage timeline

Single-source research — first reported, latest, and curated coincide.

Why it matters

MCP server security directly affects agentic AI deployments, and this hands-on code review gives defenders a grounded, evidence-based picture of which safeguards (machine-enforced annotations, path-traversal defenses) actually hold in production versus which gaps remain.

Leslie Kadenge reviewed the source of thirteen production Model Context Protocol (MCP) servers from funded companies in August 2026, cloning repos, reading tool-registration and destructive-tool handlers, and running checks such as feeding '../' and absolute paths to resolvers. The findings report that the MCP ecosystem has hardened faster than vendor fear narratives suggest: tool annotations (readOnlyHint, destructiveHint, openWorldHint) are now the norm, often enforced by non-optional types or CI conformance tests, and path handling is mostly done correctly.