MCP Security
MCP security is the practice of governing and protecting the Model Context Protocol connections that let AI agents reach external tools, data, and systems, along with the skills and other components agents load alongside them. As MCP becomes the default way agents extend themselves, it has also become one of the fastest-growing attack surfaces in the enterprise.
ON THIS PAGE
What is MCP Security?
The Model Context Protocol is a standard way for agents to connect to tools and data sources. An MCP server exposes capabilities, reading a file, querying a database, calling an API, that an agent can invoke during a task. That connectivity is powerful, and it is also a trust boundary: every server an agent connects to is code that usually went unreviewed, running with the agent's permissions.
MCP security governs that boundary. It means knowing which servers exist, what tools they expose, who invokes them, and whether a given call is safe, then controlling that activity before and during execution. Because the MCP landscape changes constantly, as developers add servers and those servers change what they do, this is not a one-time review. Agentic security tools continuously monitor the agent estate, discovering new and shadow MCP servers as they appear, scoring their risk, and flagging the ones that turn dangerous, so governance keeps pace with an environment that never holds still. It belongs to the broader job of securing the agentic supply chain, using agentic AI security, because MCP servers rarely travel alone: agents also load skills, preloaded instructions and capabilities that can carry the same risks as a malicious server, and a complete MCP security posture governs skills and servers together. It addresses MCP server security risks across the full lifecycle, from continuous discovery and vetting to runtime enforcement.
How Vulnerabilities Emerge Within the Model Context Protocol
The MCP attack surface is wide because the protocol connects agents to real systems with minimal built-in scrutiny. Common risk sources include:
Tool poisoning. A manipulated tool description or response steers the agent into an action nobody requested.
Rug pulls and drift. A server or skill quietly changes what it does after it was approved.
Shadow servers and skills. Agents connect to unreviewed MCP servers and load unvetted skills with no logging and no policy.
Over-scoped access. A single server can read sensitive data or trigger destructive actions well beyond the agent's task.
Credential exposure. Servers hold and pass upstream credentials, multiplying the blast radius of any leak.
Exposed infrastructure. Researchers have documented large numbers of MCP servers reachable on the public internet without authentication, and a steady stream of ecosystem vulnerabilities.
These risks are not hypothetical. Our research team found an unauthenticated remote code execution flaw in a widely used MCP server: see CVE-2026-38924. Strong AI agentic security can help treat every MCP server and skill as untrusted until it is discovered, scored, and governed.
Key Benefits of Securing MCP Servers and the Tradeoffs Involved
The benefits of governing MCP are direct: fewer unvetted components in the environment, visibility into what agents can actually reach, and the ability to stop a dangerous call in real time rather than discovering it after the fact. The first step is continuous mapping and hardening of the entire agentic estate, sanctioned and unsanctioned, by using an Agentic AI security platform.
The tradeoffs are real and worth naming:
Coverage versus friction. Vetting every server and skill adds a step; the answer is scoped policy and fast sanctioning, not blanket blocking that pushes developers toward shadow tools.
Static versus runtime control. An allow-list is simple but blind to a clean-looking call that carries a poisoned payload. Runtime inspection catches more but requires session context.
Central control versus developer autonomy. The goal is a paved road: approved servers and skills available easily, risky ones blocked, and a quick path to request new ones.
Frequently asked questions
What are the most critical security risks associated with MCP implementations?
Tool poisoning, rug pulls, shadow servers and skills, over-scoped access, and credential exposure. The unifying danger is that MCP calls happen through legitimate connections, so a malicious action can look identical to a routine one without session context.
How does MCP security differ from general API security practices?
API security governs how services authenticate and exchange data. MCP security adds the agentic dimension: the caller is an autonomous agent that decides on its own which tool to invoke and why, so intent and session context matter as much as the request itself.
Can prompt injection attacks be carried out through MCP connections?
Yes. A malicious MCP server can return tool responses containing hidden instructions, a form of indirect prompt injection. The agent may follow them as if they were legitimate, which is why inspecting behavior against user intent is essential.
Which teams should own MCP security within an organization?
Security owns policy, scoring, and enforcement; platform and engineering teams own which servers and skills agents use and how they are built. In practice MCP security works best as a shared model, with security setting guardrails and builders operating inside them.
Related terms
See what your agents are actually doing.
Dash discovers every AI agent, tool, and MCP server across your estate, understands session and intent, and enforces policy at runtime.