Fundamentals

    What Is MCP Security?
    When AI Connects to Your Systems

    MCP (Model Context Protocol) is an open protocol that standardises how AI connects to external data and tools. The convenience it adds arrives with a control surface that has to be managed.

    What MCP Is Made Of

    Four pieces matter from a security point of view.

    Host (AI client)

    The agent or assistant itself. It connects to MCP servers, receives their tool list, and calls what it judges necessary.

    MCP server

    Sits in front of a system — wiki, database, ticketing, code repository — and exposes tools and resources in a standard shape.

    Tools

    The function that actually runs — a read, or a delete. Each ships with a description and an argument schema.

    Credentials

    The token the server uses against the target system. Whatever scope it carries is, in practice, the agent's scope.

    5 Risks MCP Creates

    Not flaws in the protocol — structural risks that appear as connections multiply.

    01

    There is no inventory

    Servers a developer wired up alone never reach the security team's inventory. Without knowing what is connected, no other control holds.

    02

    Tool descriptions sit inside the trust boundary

    Agents decide from tool descriptions. Hidden instructions planted there steer behaviour while the tool still looks normal to the user.

    03

    What it reads becomes an instruction

    Text planted in a document, ticket, or issue is read as an instruction. The attacker never needs to touch the AI directly.

    04

    Each call is fine; the chain is not

    Data read by one tool leaves through another. Inspect any single call and nothing looks like a violation.

    05

    Nothing records what changed

    Conversation logs are not enough. Without tool-call-level records, neither incident analysis nor regulatory response is possible.

    5 Things to Settle First

    Vendor-neutral controls, in the order they matter.

    1. 1Build the inventory of connected MCP servers and their credentials — visibility before control.
    2. 2Split read from write at the tool level, and narrow the scope at issuance.
    3. 3Design so content the agent reads is treated as data, never as instructions.
    4. 4Take irreversible actions out of automation and route them to approval.
    5. 5Log at the tool-call level and keep those records tamper-resistant.

    Frequently Asked Questions

    Issuance is effectively the only control point; plans to open wide now and narrow later are rarely carried out. Split read from write per tool, and put irreversible operations — deletion, transmission, payment, permission changes — behind separate credentials and an approval step.

    Related Resources

    Start by Finding Out What Is Connected

    In most organizations AI tools are already wired into internal systems, and security has no inventory of them.