State of MCP security in Francophone African mobile money (Oct 2026)
he first security review of the MCP servers that move money across Francophone West and Central Africa. Seven servers across a dozen countries, none of which had ever been audited: Orange Money WebPay (about 12 countries including Cameroon), MTN MoMo, CinetPay, Deggo, Wave and others. Five findings, all disclosed to the maintainers before publication (theYahia/WWmcp#73 and Tahsine/momo-mcp#1). It covers the layer the model reads rather than the code: - a partner PIN passed as a tool parameter, so it arrives in the model's context window; - an outbound payout primitive with no spend ceiling, no beneficiary allow-list and no approval gate, whose own description tells the model that no further friction applies; - payer_message, free text displayed on a payer's handset with no template — the model composes the message a victim reads before entering their PIN. It also documents a false positive found in the author's own scanner, and explains why a training corpus with no non-English text produces a detector that flags every properly documented tool. Published in English and French. Fully reproducible: the tool-definition dump and a test that pins the report's numbers ship in the repository.
- Category
- Research
- Pricing
- Not listed
- Country
- 🇨🇲 Cameroon
- Last verified
- Not recorded
{ "name": "State of MCP security in Francophone African mobile money (Oct 2026)", "slug": "state-of-mcp-security-in-francophone-african-mobile-money-oct-2026", "category": "RESEARCH", "country": "CM", "docs_status": "LIVE", "licensing_required": "NONE", "verified": false, "last_verified": null, "website": "https://github.com/bryand410/mcp-scrutiny/blob/main/docs/2026-10-francophone-mobile-money-mcp-security.md", "documentation_url": null}Related in Research
AfriQA: Cross-lingual Open-Retrieval Question Answering for African Languages
AfriQA is the first cross-lingual open-retrieval question answering benchmark for African languages, with more than 12,000 XOR-QA examples across 10 African languages. The paper shows that current automatic translation and multilingual retrieval methods perform poorly for these languages, where in-language digital content is scarce.
AfriSenti: A Twitter Sentiment Analysis Benchmark for African Languages
AfriSenti is a sentiment analysis benchmark of more than 110,000 tweets in 14 African languages spanning four language families, annotated by native speakers. It underpinned SemEval-2023 Task 12, a shared task that attracted more than 200 participants, and documents data collection, annotation and baseline methods for low-resource languages.
AfriMTE and AfriCOMET: Enhancing COMET to Embrace Under-resourced African Languages
This paper introduces AfriMTE, human translation-evaluation data with simplified annotation guidelines for 13 African languages, and AfriCOMET, a learned machine translation quality metric built on an African-centric multilingual encoder. It addresses the difficulty of measuring translation progress for under-resourced African languages and reports improved correlation with human judgment over existing metrics.