NSA MCP Security Guidance: Asqav Coverage

Asqav implements every NSA Model Context Protocol security recommendation that applies to signed compliance receipts and audit infrastructure. The Cybersecurity Information Sheet sets out nine recommendations spanning several product categories.

Asqav covers the receipt and audit layer end to end through "Sign and verify MCP messages" and "Instrument for logging and detection". It extends three adjacent recommendations: "Design for boundaries", "Filter and monitor output pipelines", and "Track and patch MCP related vulnerabilities". It intentionally excludes four that belong to separate categories such as outgoing proxies, operating-system sandboxing, per-tool parameter validation, and network scanning.

Eight new receipt fields strengthen the core coverage and extend the Access control RBAC concern.

NSA CSI identifier: U/OO/6030316-26 | PP-26-1834 | May 2026 V.1.0. Read it on nsa.gov.

Direct coverage

Sign and verify MCP messages (NSA p.12)

MCP messages should include expiration timestamps and replay protection metadata to guard against delayed or duplicated messages, which is a known risk in distributed or event driven systems. NSA CSI U/OO/6030316-26, p.12

Asqav implements via:

• signature_records.signed_at (UTC, server-issued. Client clock skew cannot defeat replay protection).
• signature_records.expires_at for time-bound receipts, and signature_records.nonce, a value a consumer keys its own duplicate check on (see Time-Bound Receipts for exactly which nonce-uniqueness properties the server enforces today).
• uq_sigrec_obs_dedup partial unique index on (org_id, body_sha256, signed_at) rejects duplicates at the signer.
• ML-DSA-65 (NIST FIPS 204) post-quantum signatures over the signed envelope. Verify key exposed at GET /.well-known/jwks.json.
• Wire format published in draft-marques-asqav-compliance-receipts on the IETF Datatracker.

Instrument for logging and detection (NSA p.13)

All tool and model invocations should be logged, including the exact parameters, identities involved, and (where feasible) cryptographic hashes of results or output. These logs form the backbone of forensic response in the event of a breach or anomaly. NSA CSI U/OO/6030316-26, p.13

Asqav implements via:

• signature_records columns: action_type (namespace:verb token from /.well-known/governance.json), action_hash (request digest), payload_digest, agent_id, signed_at, receipt_type, capture_topology.
• signature_records.result_digest (SHA-256 of the canonical-JSON tool response body) closes the "cryptographic hashes of results" leg of NSA's recommendation.
• signature_records.tool_fingerprint (<registry>:<server_id>:<tool_name>@<version_hash>) anchors which tool actually ran.
• signature_records.config_manifest_digest (SHA-256 of the active tools/list manifest) lets a SIEM rule detect silent capability drift between successive receipts.
• signature_records.cve_inventory_digest binds each receipt to the CVE-feed snapshot in effect at signing time.
• POST /api/v1/observations/llm-egress accepts batched rows compatible with Splunk HEC, Elastic Logstash, and Datadog logs intake.
• asqav audit-pack export produces a tarball with the receipts, the verify key, and the IETF receipt-format reference for offline auditor verification.

Partial coverage

Design for boundaries (NSA p.11)

In order to protect the MCP environment, use a filtering outgoing proxy (e.g., Squid, tinyproxy) or an enterprise data loss prevention (DLP) solution, with specific resource URLs and access methods, for connections destined to external entities. NSA CSI U/OO/6030316-26, p.11

Asqav makes boundary violations auditable after the fact via per-tool receipts. Asqav is not a filtering outgoing proxy and is not a DLP solution.

Filter and monitor output pipelines (NSA p.12)

output filtering should include detection of indirect prompt injection or toolchain pivot attempts. In multi-component MCP pipelines, this includes logging and inspecting the output of each MCP tool before passing it to the next, to identify injected prompts or code elements that may alter downstream behavior. NSA CSI U/OO/6030316-26, p.12

When content scanning runs on a sign, the signed receipt's server-built controls_evaluated.content_scan key records that the scan executed. An absent key means scanning never ran for that action. Asqav is not an in-line interception proxy.

Track and patch MCP related vulnerabilities (NSA p.13)

Internally, an organization should maintain a clear inventory of all deployed MCP agents and tools, along with versioning, patch history, and known security concerns. NSA CSI U/OO/6030316-26, p.13

Asqav itself runs Trivy, pip-audit, and osv-scanner on every release and gates ship on HIGH or CRITICAL findings. signature_records.cve_inventory_digest pins each receipt to the CVE-feed snapshot used at signing, which makes "did we sign anything under a vulnerable tool version?" a single SQL query. Asqav does not operate a customer-facing CVE service for downstream MCP projects.

Adjacent coverage

Access control RBAC concern (NSA p.4)

MCP currently lacks support for exchanging Role Based Access Control (RBAC) permissions at instantiation, making it difficult to enforce or verify access boundaries between tasks or services. NSA CSI U/OO/6030316-26, p.4

Asqav binds the principal's then-granted authority into each receipt via signature_records.granted_scopes (TEXT[], canonical-sorted) and signature_records.scope_source (oauth_token, static_config, policy_engine, or none). A false-attestation guard rejects receipts that claim scopes without a declared source. Compliance can prove every action was inside the principal's then-granted authority with one SQL count.

Tool parameter injection (NSA p.8)

Open source MCP agents were observed exposing sensitive MCP server data after unsanitized tool parameters, passed via malformed MCP messages, were executed using simple tools. NSA CSI U/OO/6030316-26, p.8

signature_records.parameter_validation (JSONB: schema_digest, validator, outcome, rule_violations) records the cryptographic claim that these parameters were checked against this schema by this validator with this outcome. Asqav signs the validation verdict. It does not stand in front of the MCP server to enforce schemas.

Architectural choices

• Post-quantum signed receipts: why Asqav ships ML-DSA-65 instead of Ed25519 for receipts retained six to ten years.
• Out-of-process signing: self-hosted signer architecture for high-assurance and air-gapped deployments.

Out of scope (different product class)

• Choose supported MCP projects (procurement guidance, NSA p.10).
• Validate parameters (per-server schema enforcement, NSA p.11).
• Constrain and sandbox tool execution (OS-level frameworks, NSA p.12).
• Scan local network for open or vulnerable MCP servers (NSA names MCP Scanner, Ramparts, CyberMCP, and Proximity, NSA p.14).