At A Glance
- In May 2026, the National Security Agency (NSA) published its first security guidance written specifically for the Model Context Protocol (MCP), with nine recommendations for organizations running MCP in production.
- The recommendations fall across three control layers: identity, network, and application. No single product covers all nine.
- NetFoundry enforces the identity and network controls: segmentation by identity, default-deny reachability, cryptographic endpoint identity, access logging to your SIEM, and keeping MCP servers off the public internet.
- Application controls stay with your developers and security teams: parameter validation, output filtering, sandboxing, message signing, and patching.
On May 20, 2026, the NSA’s Artificial Intelligence Security Center released Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation, its first guidance written specifically for MCP. The document closes with nine recommendations, presented as a flat list with no owners attached. Security teams still have to decide which tool and which team enforces each one. We mapped all nine to the identity, network, or application control that enforces them and marked which ones NetFoundry handles. The NSA frames every recommendation as a control organizations must add on top of MCP, because the protocol itself enforces very little security.
What does the NSA’s MCP security guidance recommend?
The NSA’s core finding is that MCP’s security depends on how each team implements it. The protocol leaves authentication optional, relies on TLS for transport, and cannot verify message integrity on its own. To close those gaps, the NSA recommends nine controls:
- Choose supported MCP projects when possible
- Design for boundaries
- Validate parameters
- Constrain and sandbox tool execution
- Sign and verify MCP messages
- Filter and monitor output pipelines and chained execution
- Instrument for logging and detection
- Track and patch MCP-related vulnerabilities
- Scan your network for open or vulnerable MCP servers
The NSA notes that teams can apply most of these with standard tools such as reverse proxies, middleware firewalls, and application sandboxing frameworks.
Which control layer enforces each NSA MCP recommendation?
The NSA’s own text points to a mix of tools. It says MCP-aware security proxies remain limited and are still maturing, so a single gateway product covers only part of the list. No single product covers all nine recommendations, so every MCP program needs a named owner for each control layer. The table below assigns each recommendation to its layer and to the tool or team that enforces it.
| NSA recommendation | Control layer | Where it is enforced |
| 1. Choose supported MCP projects | Application / supply chain | Your development and procurement teams |
| 2. Design for boundaries | Network | NetFoundry enforces boundaries by identity. A DLP proxy inspects content. |
| 3. Validate parameters | Application | Your MCP server and agent code |
| 4. Constrain and sandbox tool execution | Application + Network | OS sandbox on your hosts. NetFoundry enforces network reach (default-deny). |
| 5. Sign and verify MCP messages | Application + Identity | Message signing in your application. Endpoint identity and encrypted transport from NetFoundry. |
| 6. Filter and monitor output and chained execution | Application | Your agent pipeline |
| 7. Instrument logging and detection to a SIEM | Identity + Application | Access events from NetFoundry. Invocation content from your application. |
| 8. Track and patch MCP vulnerabilities | Application / operations | Your vulnerability management. NetFoundry keeps unpatched servers off the public internet while fixes roll out. |
| 9. Scan for open or vulnerable MCP servers | Network / discovery | Your security operations run the scans. NetFoundry removes inbound exposure for servers it connects. |
Five of the nine recommendations involve the identity or network layer, which is where NetFoundry works. The other four sit entirely with application, host, and operations teams.
Which NSA MCP recommendations does NetFoundry enforce?
NetFoundry works at the identity and network layers, and five of the NSA’s nine recommendations call for controls there. For each one, NetFoundry enforces the connectivity piece, and your application or security team owns whatever sits above it.
Design for Boundaries
NetFoundry defines trust zones by identity and attribute and enforces them at the connector. An agent reaches only the tools and services its policy allows, which matches the NSA’s advice to group tools by data classification zone.
Constrain and Sandbox Tool Execution
NetFoundry handles the network side of this recommendation by denying reachability by default. A tool has no network path to any service it was not explicitly granted, in line with the NSA’s direction to deny unneeded access to internal networks at runtime.
Sign and Verify MCP Messages
The NSA recommends cryptographic signatures inside the MCP payload because the protocol cannot verify integrity on its own. NetFoundry covers the identity and transport side. It authenticates every endpoint with X.509 certificates and carries traffic over mutually authenticated, end-to-end encrypted connections. Payload-level signing still belongs in your application.
Instrument for Logging and Detection
NetFoundry records which identity reached which service and sends those access events to your Security Information and Event Management (SIEM) system. The NSA also asks for invocation parameters and output hashes, which your application has to log.
Scan for Open or Vulnerable MCP Servers
The NSA recommends regular checks for MCP servers that are unauthenticated, vulnerable, unauthorized, or reachable from the internet. MCP servers behind NetFoundry connectors dial out and have no inbound port or public DNS record, so they never show up as internet-exposed services. Your scans still matter for finding MCP servers deployed outside NetFoundry and for flagging outdated versions.
Together, these five controls determine who can reach your MCP servers and leave a record of every connection. The remaining controls deal with what happens inside the application once a connection is made.
Which NSA MCP controls stay with application and security teams?
NetFoundry does not vet MCP projects, validate tool parameters, inspect payloads for prompt injection, sandbox processes at the operating system level, sign individual MCP messages, or patch servers. Those controls belong to agent developers, platform owners, and security operations. NetFoundry holds no keys to your traffic and cannot inspect its content, so data loss prevention (DLP) and output filtering need tools built for content inspection. The NSA names specific options for several of these, including outbound filtering proxies such as Squid and operating system frameworks such as SELinux, AppArmor, and seccomp.
How to map your MCP program to the NSA’s nine recommendations
The NSA wrote this guidance for National Security Systems, Department of War (formerly the Department of Defense), and Defense Industrial Base information systems, so defense contractors and federal program teams have the most direct reason to act on it. For those teams, identity and network controls are the easiest to show an assessor: who can reach which MCP tool, under which policy, with a record of every connection. Assign each of the nine recommendations to a control layer and a named owner, and you can show exactly where each one is enforced.
NetFoundry built and maintains OpenZiti, the open-source Zero Trust networking platform, and delivers it for machine workloads such as AI agents and MCP servers. Because NetFoundry is software-only and runs NetFoundry-hosted, self-hosted, or air-gapped, the same identity and network controls apply in a classified enclave and a commercial cloud. [Verify against netfoundry.io/company] The NSA does not endorse commercial products, and this mapping reflects NetFoundry’s own analysis of the guidance.
Map your MCP controls with our team: Talk to Us
Frequently Asked Questions
Does NetFoundry make an organization compliant with the NSA’s MCP guidance?
The NSA’s MCP guidance is a Cybersecurity Information Sheet: a set of advisory recommendations with no certification process attached. NetFoundry enforces the identity and network recommendations and supplies access logs for SIEM monitoring. Full alignment also requires controls that application and operations teams own, including parameter validation, output filtering, and patching.
Does NetFoundry scan for exposed MCP servers?
The NSA recommends that organizations regularly scan their networks for unauthenticated, vulnerable, or unauthorized MCP servers. NetFoundry does not run those scans. MCP servers connected through NetFoundry have no inbound port and no public DNS record, so attackers cannot reach them from the internet. We still recommend running the scans to catch MCP servers deployed outside NetFoundry.
How is NetFoundry different from MCP governance products from Zscaler, Netskope, or Cloudflare?
MCP gateway and proxy products focus on inspecting traffic content, such as checking prompts and tool outputs. NetFoundry works at the connectivity layer: it controls which identities can reach which MCP servers and keeps those servers off the public internet. A complete MCP security program uses both kinds of control.
How do you secure MCP servers with Zero Trust?
Zero Trust for MCP means no agent or tool can reach an MCP server until it proves its identity and a policy explicitly allows the connection. NetFoundry applies this by giving every agent and server a cryptographic identity, denying all connections by default, and hiding MCP servers from the internet entirely. Application-level controls such as input validation and output filtering complete the picture.
Can NetFoundry’s MCP controls run in an air-gapped or classified environment?
Yes. NetFoundry is software-only and runs NetFoundry-hosted, self-hosted, or air-gapped, so the same identity and network controls apply across commercial and classified environments.
