MCP server security
The Model Context Protocol (MCP) is a standard way for agents to discover and call external tools. That makes an MCP server the precise point where an agent acquires new capability — and therefore a control point worth governing deliberately, because a compromised or over-permissioned server extends every connected agent at once.
Updated 2026-09-18
Risks specific to the protocol
These arise from MCP's design as a dynamic capability layer rather than from any individual implementation.
- Tool description as an injection surface — an agent reads tool metadata to decide what to call, so that metadata is untrusted input.
- Capability drift — a server adds or changes tools after approval, silently widening what connected agents can do.
- Over-broad tool scope — one tool that "runs a query" against a database with write access.
- Credential concentration — a server holding tokens for many downstream systems becomes a single high-value target.
- Unattributed calls — the downstream system sees the server, not the agent or the person behind it.
- Unvetted third-party servers installed by developers without review.
Controls that fit the protocol
Treat an MCP server as a privileged integration, not a developer convenience. Register each server and pin the tool set it is approved to expose, so drift is a detectable event rather than an invisible one. Scope tools narrowly enough that the permission matches the task. Broker credentials so the server holds a capability rather than a reusable secret.
Most importantly, preserve attribution: the agent identity and initiating principal should survive the hop through the server, or the audit trail terminates at the integration.
Why this is a good first control point
MCP adoption tends to concentrate agent capability in a small number of servers. That concentration is a risk, but it is also leverage: governing a handful of servers can cover a large share of what agents can actually do, which is a faster path to meaningful coverage than instrumenting every agent individually.
Common questions
- What is the main MCP security risk?
- Tool descriptions are read by the agent to decide what to call, which makes server-supplied metadata an injection surface. Combined with over-broad tool scope, it lets one compromised server extend every connected agent.
- How do you secure an MCP server?
- Register it, pin the approved tool set so capability drift is detectable, scope tools narrowly, broker credentials rather than handing over reusable secrets, and preserve agent attribution through the hop.
- Should developers install third-party MCP servers?
- Not without review. A third-party server grants new capability to every agent connected to it and often holds credentials for downstream systems.