The scope of this Working Group is the development and maintenance of the
SAF-MCP Mitigations specification: the catalog of security mitigations
(SAF-M identifiers) for the Model Context Protocol (MCP) ecosystem,
consisting of the contents of the mitigations/ directory and the
MITIGATIONS.md reference document in the SAF-MCP repository.
This includes:
- Mitigation identifiers (SAF-M-*), names, and descriptions
- Mitigation categories and effectiveness ratings
- Implementation guidance, considerations, and examples within mitigation documents
- Mappings between mitigations and SAF-MCP techniques (SAF-T identifiers)
This Scope does not include:
- The SAF-MCP techniques documentation (
techniques/), which is licensed under CC BY 4.0 - Code, including scripts, detection rules, and software implementations, which is licensed under the Apache License, Version 2.0
Any changes of Scope are not retroactive.
This Working Group is governed by the Community Specification Governance Policy 1.0. Notices, including license acceptance, withdrawals, and patent exclusions, are recorded in NOTICES.md.