Field notes

MCP Security Blog

Practical guides on MCP security, MCP prompt injection, layered runtime enforcement, and AI agent security in production.

Coverage map
01MCP runtime security
02Governed execution
03EU AI Act evidence
04Agent threat models
Release Analysis·June 7, 2026·15 min read·By Quinten Stroobants

Why MCP Security Needs Layered Runtime Enforcement

Historical v2.1.0 release analysis: preflight normalization, deterministic blocking, camouflage detection, semantic scoring as an advisor, behavioral signals, and explicit policy composition.

Read Article
Layered MCP runtime enforcement path showing L0 preflight, L1 rules and safe zones, L1.5 camouflage, L2 semantic advisor, L3 behavioral risk, and policy composer.
Featured VisualRelease Analysis

Historical v2.1.0 release analysis: deterministic controls own known hazards, while semantic scoring adds advisory context.

02
Governance·June 4, 2026·10 min read·By ProvnAI Research Team

EU AI Act Evidence Architecture for Autonomous Agents

Articles 13, 14, and 17 mapped to technical evidence architecture for autonomous AI governance workflows.

Read
03
Security·June 4, 2026·9 min read·By ProvnAI Research Team

What Is an MCP Security Proxy? Prompt Injection Defense

What an MCP security proxy is, how it inspects routed tool calls, and where deterministic policy can reduce prompt-injection impact before execution.

Read
Follow the thread

Go deeper on MCP security.

Open the docs
Start with the boundary

What is an MCP security proxy?

A plain-language explanation of where a proxy fits, what it can inspect, and what it does not replace.

Deploy the control

McpVanguard

Explore the open-source gateway, enforcement profiles, routed transports, and deployment paths.

Study the threat

Prompt injection and tool poisoning

Read the research framing for indirect instructions, metadata camouflage, and tool-call risk.

Contribute

Write with us

Working on MCP security, agent governance, or formal verification? We publish original technical research and collaborate with security engineers and architects.

Get in touch