September 2026 Summaries

Model Context Protocol (MCP), originally designed to help AI clients discover and invoke tools, is increasingly functioning as an identity and authorization layer because connected servers hold credentials, define tool scopes, and approve agent actions. Although the November 2025 MCP specification supports OAuth-based, server-scoped authorization, adoption and implementation remain inconsistent: a May 2026 study of 7,973 remote servers found 40.55% had no authentication, while all tested OAuth-enabled servers contained at least one security flaw, and more than 300 CVEs have been reported for MCP infrastructure. The author argues that weakly configured servers can create blended identities in which an agent acts through a mix of user permissions, server-held credentials, and session state, enabling confused-deputy attacks, excessive access, and tool-poisoning risks. Unsanctioned “shadow MCP” deployments further complicate governance by introducing unmonitored credential-bearing services, amid survey findings that fewer than half of organizational AI agents are actively monitored or secured. Recommended controls include treating MCP servers as identity infrastructure, inventorying reachable servers, using OAuth 2.1 and short-lived scoped credentials, evaluating authorization for each call against the initiating user, enforcing argument-level approvals for sensitive actions, and managing agent grants as revocable non-human identities rather than persistent shared credentials.