MCP spec project formalizes EU Cyber Resilience Act incident-reporting guidance

The Model Context Protocol maintainers merged pull request #3526, "docs: add EU Cyber Resilience Act stewardship guidance," on November 13, 2026, setting out how the project will meet its EU Cyber Resilience Act incident-reporting obligations.

What changed

• The MCP maintainers merged pull request #3526, "docs: add EU Cyber Resilience Act stewardship guidance," on November 13, 2026.
• The change edits SECURITY.md, docs/community/policies.mdx and docs/community/contributor-ladder.mdx.
• GitHub Security Advisories is now the formal emergency vulnerability-reporting channel under the EU Cyber Resilience Act (CRA).
• Reporters must flag whether a vulnerability is actively exploited or tied to an ongoing incident.
• Core and Lead Maintainers must escalate actively exploited vulnerabilities or severe incidents to the Linux Foundation's CRA steward immediately, under 24-hour early-warning and 72-hour notification thresholds mirroring CRA Article 14.
• A private #security-disclosures channel was created as the internal notification route, while individual MCP SDK repos keep their own separate SECURITY.md files.

What it means for builders

MCP server and SDK maintainers now have a documented compliance path for the EU Cyber Resilience Act's incident-reporting deadlines. The guidance is the protocol's first formal response to incoming CRA obligations that affect any EU-facing MCP deployment. Reporters and maintainers know which channel to use, how fast escalation must happen, and who speaks for the project, since designated maintainers represent it to the Linux Foundation's CRA steward with one voice, even though individual MCP SDK repositories keep their own separate SECURITY.md files.

Sources

• docs: add EU Cyber Resilience Act stewardship guidance (Model Context Protocol (GitHub), November 13, 2026, official)

Written with AI assistance, strictly from the sources listed above. Before it went live, automated checks verified its dates, sources and every language edition.