Every implementation (build platforms included) must follow industry security best practice to conform to the specification, including at least proper access control, secured communications, proper management of cryptographic secrets, frequent updates and prompt fixing of known vulnerabilities. Guides such as the CIS Critical Security Controls may be consulted. The specification does not itself define what a secure platform is.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.