The specification's security guidance covers relying on securing mechanism specifications, key management, content integrity protection of linked content, unsigned claims, man-in-the-middle, replay and spoofing attacks, bundling dependent claims, highly dynamic information, device theft and impersonation, unauthorised and inappropriate use, and code injection through credential content.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.