Scope

The scope of this Working Group is the development and maintenance of the SAF-MCP Mitigations specification: the catalog of security mitigations (SAF-M identifiers) for the Model Context Protocol (MCP) ecosystem, consisting of the contents of the mitigations/ directory and the MITIGATIONS.md reference document in the SAF-MCP repository.

This includes:

• Mitigation identifiers (SAF-M-*), names, and descriptions
• Mitigation categories and effectiveness ratings
• Implementation guidance, considerations, and examples within mitigation documents
• Mappings between mitigations and SAF-MCP techniques (SAF-T identifiers)

This Scope does not include:

• The SAF-MCP techniques documentation (techniques/), which is licensed under CC BY 4.0
• Code, including scripts, detection rules, and software implementations, which is licensed under the Apache License, Version 2.0

Any changes of Scope are not retroactive.