Skip to content
T threat.cafe

Tag

#dataset

2 posts

  1. · Margot Reyes · Original research and datasets · on threat.cafe

    The official MCP Registry has no security fields: what a registry listing does and doesn't tell you

    An MCP Registry listing proves a publisher controls a namespace and, for packages, the package. It does not prove review, safe code, or control of a remote URL. The schema has no security field at all.

  2. · Margot Reyes · Original research and datasets · on threat.cafe

    The 2026 agent-ecosystem incident ledger: ten malicious skills, MCP servers and lures, sourced and dated

    Ten publicly documented incidents, each traced to the finder's write-up or an advisory, fall into four repeat patterns. Lookalike MCP servers lead with five. Removal time is public for only two.