{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2026:KYXS6NW3P7RI7IPKADANY6EVHL","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"9597af3bf4d0f23c98013d6447e3191c5ad6595b75dc6ab8664ee96ce25f6137","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-31T16:46:19Z","title_canon_sha256":"e4a55ea9e6724318d7e34e64220216b1ad44cb688f4c4b9de20d3f622e732afd"},"schema_version":"1.0","source":{"id":"2608.00150","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2608.00150","created_at":"2026-08-04T00:33:04Z"},{"alias_kind":"arxiv_version","alias_value":"2608.00150v1","created_at":"2026-08-04T00:33:04Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2608.00150","created_at":"2026-08-04T00:33:04Z"},{"alias_kind":"pith_short_12","alias_value":"KYXS6NW3P7RI","created_at":"2026-08-04T00:33:04Z"},{"alias_kind":"pith_short_16","alias_value":"KYXS6NW3P7RI7IPK","created_at":"2026-08-04T00:33:04Z"},{"alias_kind":"pith_short_8","alias_value":"KYXS6NW3","created_at":"2026-08-04T00:33:04Z"}],"graph_snapshots":[{"event_id":"sha256:b56fedc56218bab8d3654a2d33cb1fc1afd092dffe06a0e4fc5bdb20a9c2aa65","target":"graph","created_at":"2026-08-04T00:33:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2608.00150/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"The Model Context Protocol (MCP) has seen rapid adoption since its November 2024 launch, with over 21,000 server instances detectable on the public internet. We present the first dynamic behavioral security assessment of internet-facing MCP servers, combining passive discovery across eleven data sources (crt.sh, HuggingFace, GitHub, npm, Smithery, PyPI, Censys, FOFA, Shodan, glama.ai, and pulsemcp.com) with active dynamic testing using Corvus, a purpose-built framework implementing 34 test modules covering 10 MCP-specific vulnerability classes. Across four measurement runs spanning July 2026, ","authors_text":"Nicol\\'as Padilla","cross_cats":["cs.AI"],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-31T16:46:19Z","title":"Exposed by Design: A Dynamic Security Assessment of Internet-Facing MCP Servers at Scale"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2608.00150","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:e3caa28b94fe723cdf40984a4c757273b3de2a062d03c5299794a398aa496f35","target":"record","created_at":"2026-08-04T00:33:04Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"9597af3bf4d0f23c98013d6447e3191c5ad6595b75dc6ab8664ee96ce25f6137","cross_cats_sorted":["cs.AI"],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2026-07-31T16:46:19Z","title_canon_sha256":"e4a55ea9e6724318d7e34e64220216b1ad44cb688f4c4b9de20d3f622e732afd"},"schema_version":"1.0","source":{"id":"2608.00150","kind":"arxiv","version":1}},"canonical_sha256":"562f2f36db7fe28fa1ea00c0dc78953aca534447d4f3a2232a79de043d265661","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"562f2f36db7fe28fa1ea00c0dc78953aca534447d4f3a2232a79de043d265661","first_computed_at":"2026-08-04T00:33:04.514123Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-08-04T00:33:04.514123Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"pdhOW2SxCW6vNFR9GHlfw00R2Wwuxd61LC3q7xpGC2+rwX7nRoiUo0NYA03vVttX3kc4deYPDDvxGDHnXO7TCw==","signature_status":"signed_v1","signed_at":"2026-08-04T00:33:04.515574Z","signed_message":"canonical_sha256_bytes"},"source_id":"2608.00150","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:e3caa28b94fe723cdf40984a4c757273b3de2a062d03c5299794a398aa496f35","sha256:b56fedc56218bab8d3654a2d33cb1fc1afd092dffe06a0e4fc5bdb20a9c2aa65"],"state_sha256":"d11d29acdbaa180eee19880a4562c9648a63c3eb5390933572557cd808c8cb64"}