TL;DR
- MCP security is the set of practices and controls that protect Model Context Protocol (MCP) servers, clients, tools, and the data they access from attack, misuse, and unauthorized activity.
- As a widely used “universal adapter” that connects AI agents to software programs and data sources, the Model Context Protocol (MCP) is an important layer of many agentic AI technology stacks.
- However, MCP also introduces a variety of security risks. Common MCP attack vectors include tool poisoning, confused deputy, token passthrough, SSRF via connectors, and rogue server registration.
- These risks are far from theoretical. Per Knostic research reported in Dark Reading (2025), ‘approximately all’ of the ~2,000 MCP servers exposed to the Web lack any authentication or access controls.”
- Research by OX has also uncovered a massive MCP architectural flaw that places an estimated 200,000 instances at risk of arbitrary code execution.
- Securing MCP servers against risks like these requires practices such as leveraging OAuth 2.1, using provenance and attestation to verify code integrity, isolating or sandboxing MCP servers, employing inline policies, and centralizing MCP governance.
- An AI-native application protection platform (AINAPP) provides the capabilities necessary to detect and mitigate MCP security risks alongside other threats to AI models, agents and related technology.
Understanding MCP and MCP Security Risks
The Model Context Protocol (MCP) is a framework designed for connecting AI agents to external tools and data sources. It works by using a standards-based client-server architecture to allow AI agents to access external resources.
Typically, AI agents receive guidance from a large language model (LLM), which tells them which tools, commands, and/or data they need to accomplish a task. However, to perform tasks, agents also need a way of actually connecting to the relevant software applications and/or data sources.
This is where MCP comes in: Using MCP, organizations can operate “servers,” which expose software programs or data sources. Then, AI agents can connect to these resources by establishing connections as MCP “clients.”
To place this in real-world context, imagine an AI agent whose job is to run performance tests against release candidates within a software development pipeline. A developer might assign the agent a task such as “evaluate how the latest build performs under varying levels of load.” To carry out the assignment, the agent would ask an LLM which commands or API calls it needs to run against the application to simulate different levels of load and monitor its response.
To execute these commands, the agent would connect to an MCP server that makes the necessary tools available. It might also use a separate MCP server to connect to monitoring software, which it would leverage to assess how well the application performs when placed under load.
MCP, which was introduced by Anthropic in 2024, is not the only way to connect AI agents to external tools and data. Other approaches include strategies like writing custom code to connect agents directly to external resources.
However, the value of MCP is that it’s an open, universal standard with open source SDKs. Any AI agent that is designed to be compatible with MCP can connect to any resource that is exposed via MCP. Hence why MCP has gained widespread popularity; 41% of software organizations now run MCP in production, according to Stacklok’s State of MCP in Software survey (2026).
Common MCP Vulnerabilities
While MCP makes it easy to enable AI agents with the capabilities they need to carry out tasks, it also has the potential to expose organizations to a variety of security risks. Common vulnerabilities include:
- Tool Poisoning: Attackers can manipulate an MCP tool’s metadata or descriptions to trick an AI agent into executing malicious actions or disclosing sensitive information.
- Confused Deputy: An attacker may abuse an MCP server’s trusted privileges to make it perform actions on behalf of an unauthorized user or application.
- Token Passthrough: An MCP server that improperly accepts and forwards authentication tokens intended for another service potentially allows attackers to gain unauthorized access.
- SSRF via Connectors: Attackers could exploit MCP connectors to perform server-side request forgery (SSRF), which causes servers to send requests to internal or otherwise restricted resources that the attacker cannot access directly.
- Rogue Server Registration: Threat actors could register a malicious MCP server that impersonates a trusted server, potentially capturing sensitive data or influencing agent behavior.
As an example of how MCP security risks like these can materialize in the real world, let’s return to the example above of an AI agent that uses MCP to help run performance tests on a software application. Using tool poisoning, attackers could cause the agent to run commands that, rather than driving a legitimate performance test, tell the application to send sensitive data to an endpoint they control.
Or, if the MCP server used by the agent lacks effective authentication controls, threat actors could carry out a confused deputy attack by connecting their own agents to the server, then use it to run malicious commands.
To date, MCP security threats have proven to be a massive challenge for organizations. For example, OX Security’s MCP vulnerability research has identified a massive architectural flaw in MCP that enables attackers to execute arbitrary commands on up to an estimated 200,000 vulnerable instances (OX Security research, April 2026). This has led to an MCP supply chain RCE advisory involving nearly a dozen CVEs.
Common MCP Attack Vectors and Controls
| Attack Vector | How it Works | Control |
| Tool Poisoning | An attacker manipulates an MCP tool’s description, metadata, or instructions to influence an AI agent into performing unintended actions or exposing sensitive data. | Validate tool metadata and provenance, monitor for changes, and enforce inline policies that restrict high-risk tool actions |
| Confused Deputy | An attacker exploits an MCP server’s trusted privileges to make it perform actions on behalf of an unauthorized user or application | Use strong authorization, enforce least-privilege access, and verify the identity and permissions of the requester for every sensitive operation |
| Token Passthrough | An MCP server improperly accepts or forwards authentication tokens intended for another service, potentially allowing unauthorized access | Use OAuth 2.1 with scoped, audience-restricted tokens and prevent servers from accepting or forwarding tokens that were issued for other services |
| SSRF via Connectors | An attacker abuses MCP connectors to make requests to internal systems, cloud metadata services or other restricted resources that they cannot access directly | Restrict outbound network access, validate and allowlist destinations, and block requests to private, internal and metadata endpoints |
| Rogue Server Registration | An attacker registers a malicious MCP server that impersonates a trusted server or introduces unauthorized tools into an environment. | Require server authentication and provenance verification, maintain an approved server registry and use attestation before allowing servers to connect. |
Best Practices for MCP Security
Safeguarding against MCP security risks requires the adoption of techniques capable of enabling MCP to function as the flexible connector it’s designed to be, while preventing abuse of the protocol by malicious agents or threat actors.
Secure MCP Servers and Clients with OAuth 2.1
OAuth 2.1, the in-progress IETF consolidation of OAuth 2.0 and its security best practices (and the framework that MCP’s authorization specification builds on) provides the latest version of the Open Authorization (OAuth) framework, provides standardized authentication and authorization for MCP clients and servers, reducing the risk of unauthorized access and token misuse.
When implemented using short-lived tokens, scoped permissions and secure authorization flows (rather than passing tokens between services), OAuth 2.1 significantly reduces MCP security risks like confused deputy attacks.
Verify MCP Server and Tool Provenance
Provenance and attestation validation help verify where an MCP server, tool, or component came from and whether it has been modified or compromised. To ensure visibility into the provenance of MCP resources, maintain signed metadata or attestations and validate them before allowing servers or tools to connect to your environment.
Enforce Isolation and Sandboxing
Isolation limits the damage an MCP server or tool can cause if it is compromised or behaves unexpectedly. Rather than exposing all MCP servers to the Web, run untrusted servers and tools, as well as those that only require access to localized resources, in containers or other sandboxed environments with restricted network access, filesystem permissions, and system privileges.
Employ Inline Policies
The enforcement of inline policies for MCP servers and tools allows security rules to be evaluated at the point where an MCP tool request is made. Define policies that inspect the user, tool, parameters, and requested resources, then block or require approval for actions that violate those policies.
Centralize Governance
Centralized governance provides consistent visibility and security controls across MCP servers, tools, users, and agents. To this end, maintain an inventory of MCP assets and enforce common authentication, authorization, logging, policy, and approval requirements through a central control plane.
MCP Security in an AI-Native Application Protection Platform (AINAPP)
Securing MCP is one control point inside a much larger AI-native attack surface that an AI-native application protection platform (AINAPP) governs from prompt to runtime.
To mitigate MCP security risks alongside threats to other parts of an AI-enabled technology stack, an AINAPP leverages capabilities such as the validation of agent and tool code, enforcement of authentication and authorization controls for MCP servers and clients, inspection and filtering of LLM prompts, and continuous monitoring of runtime environments to detect security anomalies.
This approach delivers comprehensive agentic AI security protection, no matter how or to what extent the business relies on MCP to help power AI agents.
Keeping MCP Secure
As MCP plays an increasingly important role in the deployment of AI agents, solving MCP security challenges is critical. This is true for fundamental architectural risks like the Anthropic MCP vulnerability, as well as security flaws that are more limited in scope, such as coding mistakes within individual MCP servers or tools that attackers can abuse to run malicious commands or exfiltrate data.
Given that MCP attack vectors and security risks come in many forms, protecting MCP requires a multi-pronged approach based on a variety of capabilities – specifically, those delivered by an AINAPP. By protecting all facets of the MCP solution stack – AI agents, LLMs, MCP servers, MCP clients, and external tools – during both development and runtime, the OX AI-Native Application Protection Platform delivers the confidence organizations need to take full advantage of MCP without being slowed down by MCP security vulnerabilities.
FAQs
MCP security refers to the practices and controls used to protect Model Context Protocol (MCP) servers, tools, clients, and the data they access from attacks, misuse, and unauthorized activity.
No. The protocol does not enforce authentication; Knostic found ~1,862 internet-exposed servers with none.
Practices such as attesting server provenance to confirm that it is from a trusted source, using an approved server registry to source servers, enforcing least-privilege permissions, and operating servers in sandboxed environments helps ensure security and mitigate risks.
Common MCP security risks include tool poisoning, confused deputy attacks, token passthrough, SSRF through connectors, and rogue server registration.
Some MCP security vulnerabilities stem from oversights in the code that powers MCP servers or tools, such as a lack of input validation to prevent the injection of malicious commands via a tool or server. However, MCP is also subject to a fundamental architectural flaw that enables arbitrary code execution on misconfigured resources, with an estimated 200,000 instances currently affected.
Businesses can protect MCP servers by using strong authentication and authorization, validating server provenance, applying least-privilege access, and isolating untrusted tools and servers.
Centralized governance provides visibility into MCP servers, tools, users, and agents while enabling consistent security policies. It can also help organizations enforce access controls, monitor activity, and respond to security issues.
An AINAPP addresses MCP security risks as one control point inside the wider AI-native attack surface. It does this by governing prompts, agents, MCP servers, tool code, and cloud environments during both development and runtime.
