MCP Security in 2026: The Protocol Got Hardened. The Ecosystem Didn't.

A year of MCP CVEs, a rewritten spec, an NSA guidance sheet and an OWASP Top 10 — what actually changed, what didn't, and the six controls I'd insist on before an MCP server touches production.