This Internet-Draft analyzes recurring vulnerability classes in MCP server implementations and describes Protocol Pivoting, a cross-protocol lateral-movement pattern in systems that compose MCP with other agent protocols such as Agent-to-Agent (A2A) delegation.
Protocol Pivoting steps:
- Initial access: injected instruction enters via an MCP-using agent.
- MCP step: instruction causes agent to invoke MCP tool against internal service.
- Pivot: downstream agent inherits originating agent’s trust via different protocol.
Mitigations considering each protocol in isolation do not address movement across protocol boundaries. The document proposes security considerations for implementors and operators, and references automated detection via open-source tool mcp-safeguard.
Published June 2026. Intended Status: Informational. Expires 3 December 2026.