Go deeper
Sources & further reading
The primary sources behind the talk, the MCP authorization timeline, and where to explore next.
Frameworks & standards
Protocol & specification
Threat intelligence & incidents
Hands-on & concepts
Damn Vulnerable MCP Server (DVMCP)
A deliberately vulnerable MCP server with 10 challenges — practice tool poisoning, rug-pulls, and more, safely.
github.com“The lethal trifecta” — Simon Willison
The original framing of agent exposure: private data + untrusted content + the ability to communicate externally.
simonwillison.netReference · MCP Authorization
How MCP auth hardened, version by version
- 2024-11-05
Initial spec
No standard authorization; trust assumed in local use.
- 2025-03-26
Auth framework
OAuth 2.1 foundations introduced for remote servers.
- 2025-06-18
OAuth Resource Server
Resource indicators (RFC 8707) bind a token to one audience.
- 2025-11-25
Enterprise-ready
CIMD replaces dynamic registration; enterprise IdP policy; async Tasks.
The trajectory: From implicit local trust to audience-bound tokens and enterprise identity policy in twelve months.
Keep exploring
Back into the demo
Learn
The threat model, MCP's attack surface, the OWASP Agentic Top 10, and defense in depth.
Lethal Trifecta
Toggle autonomy, tools, and untrusted input — and watch the exploit chain form or break.
Attack Sandbox
Run a simulated agent against real attack classes, then switch on defenses and watch them block.