MCP Server Security Standard (MSSS)

MCP Server Security Standard (MSSS)

[![CC BY-SA 4.0][cc-by-sa-shield]][cc-by-sa] [](https://github.com/mcp-security-standard/mcp-server-security-standard/releases/latest) [](#how-to-contribute)

About MSSS

The Model Context Protocol enables AI models to interact with external systems through tools, resources, and prompts. As adoption accelerates, critical vulnerabilities have emerged: command injection, path traversal, SSRF attacks, and supply chain compromises.

MSSS provides:

• 24 security controls across 8 domains
• 4 compliance levels (L1-Essential, L2-Development, L3-Production, L4-Maximum Assurance)
• Risk-based level selection framework inspired by NIST CSF, OWASP ASVS, and CIS Controls
• 6 deployment profiles (Local Dev, Team Server, Internet-Facing, etc.)
• Evidence-based verification with clear acceptance criteria
• Machine-readable reporting through JSON schemas

Compliant Platforms

The following platforms have adopted the MCP Server Security Standard:

-	Platform	Description	Status
	MCP-Hub	MCP server directory and marketplace — discover, publish, and manage MCP-compliant servers	✅ Compliant

Are you implementing MSSS? [Open an issue](https://github.com/mcp-security-standard/mcp-server-security-standard/issues) or submit a PR to be listed here.

Current Status - v0.1.0

Released: **January 15, 2026** (Community Review Draft)

What's Included

• Core standard framework (msss.md)
• 6 deployment profiles defined
• Comprehensive threat model
• 23 fully documented security controls
• JSON reporting schemas
• i18n framework for translations

Areas for Community Contribution

• Implementation examples for common frameworks
• Automated verification tools
• Reference assessment reports
• Translations to other languages
• Real-world testing and feedback

Quick Start

For Implementers

...