Add MCP (Model Context Protocol) security rule

[santosomar]

Add new security rule based on CoSAI MCP Security guidelines. The rule covers:

• Workload identity and authentication (SPIFFE/SPIRE)
• Input and data sanitization for prompt injection prevention
• Sandboxing and isolation requirements
• Cryptographic verification of resources
• Transport layer security (stdio and HTTP)
• Human-in-the-loop controls
• Logging and observability
• Deployment pattern security guidance
• FixesNew Rule: MCP (Model Context Protocol) Security based on CoSAI's Security Guidelines #96

@ramraaj25 , @thomas-bartlett , @aacarter1 - please review from an MCP server developer perspective.

[Copilot]

Pull request overview

This PR adds a new security rule for MCP (Model Context Protocol) implementations based on the CoSAI MCP Security guidelines (January 2026). The rule provides comprehensive security guidance for developers implementing MCP servers and clients, addressing critical security concerns identified in recent CVEs and incidents across MCP/agentic deployments.

Changes:

• Added codeguard-0-mcp-security.md rule covering authentication, input sanitization, sandboxing, cryptographic verification, transport security, human-in-the-loop controls, logging, and deployment patterns
• Rule targets Python, JavaScript, TypeScript, Go, and Rust implementations
• Configured as context-specific rule (alwaysApply: false)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.