CVE-2026-76404 is an insecure deserialization vulnerability (CWE-502) in Splunk's MCP Server, assigned a CVSS 3.1 score of 9.1. The affected package exposes tools including run_splunk_query, get_indexes, and generate_spl, and has been downloaded over 20,000 times. Exploitation requires an admin role — a qualification that sounds reassuring until you consider that, in most SOC environments, the analysts who use Splunk day-to-day hold exactly that role. Version 1.2.1 fixes the issue.
This is not a novel class of bug. Deserialization of untrusted data has been a top-tier vulnerability category for over a decade. What makes it noteworthy in the MCP context is the trust topology: an AI agent, operating with delegated credentials, invokes a tool that deserializes a payload it was handed. The human in the loop may not see the exact arguments. The platform that brokers the call may log them — but logs are not evidence.
When an MCP gateway records that "agent X called tool Y with arguments Z," that record sits on infrastructure controlled by the same party running the agent, the gateway, or both. If an incident occurs — a malicious query exfiltrated data, a deserialization gadget executed code, a tool was called outside its intended scope — the audit trail is administered by the party with the strongest incentive to characterize events favorably.
This is not an accusation of dishonesty. It is a structural observation. Security controls that depend on self-attestation fail precisely when you need them most.
The MCP ecosystem has recognized this gap. Commercial gateways now offer inline policy enforcement. DeepInspect enforces tool-call policies with sub-50ms p95 latency and stores audit records in "tamper-evident storage." Cloudflare WriteGuard applies risk classification and deny-by-default policies. These are meaningful improvements at the policy layer — they can block known-bad calls before they reach upstream servers. But they share a common property: their evidentiary records remain under the provider's control. Tamper-evident storage administered by the same vendor that runs the enforcement plane is still, ultimately, a statement you are asked to trust.
There are two distinct questions in MCP security:
1. Should this tool call be allowed? — Policy enforcement.
2. After the fact, can a third party independently verify exactly what happened? — Cryptographic evidence.
Every existing MCP security product answers the first question well. None — to our knowledge — answers the second. The distinction matters because the second question is what determines liability, compliance, and forensic truth after an incident.
CCS Proxy v1.3.0 is an MCP enforcement proxy that sits between a client and an upstream MCP server, synchronously intercepting every tools/call request. It performs both functions — and the second one is where it diverges from every alternative.
Validates every tool call across 7 dimensions of parameter checking and binds the call to its semantic intent.
Fingerprints the upstream server's manifest, pins it, and detects drift — a compromised or swapped MCP server is caught at the protocol layer, not after exploitation.
Constructs a three-point chain — arguments_hash → forwarded request → upstream_response_hash — all bound together and signed with an Ed25519 key (RFC 8032) over JCS-canonicalized JSON (RFC 8785).
The result is a per-call receipt that any third party can verify offline. No gateway. No platform. No trust in Correctover. Given the receipt, the upstream server's public key, and the Ed25519 signature, a verifier can independently confirm: this exact tool, with these exact arguments, produced this exact response at this time.
We are not claiming CCS prevents deserialization vulnerabilities. It does not patch CVE-2026-76404 or any other upstream bug. What it provides is an evidence trail that the operator of the agent, the vendor of the gateway, and the vendor of the upstream server cannot alter. If an agent invokes run_splunk_query with a malicious payload that triggers a deserialization gadget, the receipt records the exact arguments and the exact response — signed, timestamped, and independently verifiable. That is a fundamentally different category of artifact than a log entry in a vendor-controlled datastore.
The current release passes all 22 test cases — 17 mock tests and 5 live tests against NVIDIA NIM. The deny-path latency is 97 milliseconds. The runtime has zero dependencies beyond the Python standard library. The distribution tarball is 53 KB and is itself GPG-signed, so supply-chain verification extends to the enforcement proxy itself.
This is not a research prototype. It is shipping software, and the core enforcement engine is open source under the Elastic License 2.0.
Cryptographic receipts do not eliminate vulnerabilities. They do not make a deserialization gadget unexploitable. They do not replace policy enforcement, input validation, or prompt-level guardrails. What they do is ensure that after an incident, there exists a record that no party — not the agent operator, not the gateway vendor, not the upstream provider — can modify or suppress.
In a world where AI agents hold delegated credentials and invoke tools on critical infrastructure, "trust me" logging is insufficient. The MCP protocol deserves the same evidentiary standard that TLS brought to transport and that code signing brought to distribution: a chain of trust that does not depend on the goodwill of the party being audited.
CVE-2026-76404 will be patched. The next deserialization bug in the next MCP server will arrive on schedule. The question is whether, when it does, you will have evidence — or merely a log.