MCP Security

Why It Matters

The Model Context Protocol is the connective tissue between AI agents and the outside world. When an agent needs to read a database, send an email, call an API, or modify a file, it does so through an MCP server. That makes MCP servers a single point of leverage: compromise one, and you inherit every tool and credential the agent can reach.

The scale of exposure is not theoretical. In April 2026, security firm OX Security disclosed a systemic architectural flaw in Anthropic’s official MCP SDKs — the reference implementations that most MCP servers are built on. The flaw was estimated to expose up to 200,000 vulnerable instances across a supply chain spanning an estimated 150 million downloads. The Cloud Security Alliance published a research note, ‘MCP by Design: RCE Across the AI Agent Ecosystem’ (April 2026), framing the protocol’s stdio design as an ecosystem-wide remote-code-execution risk. Academic research from the MCPInspect study (arXiv 2510.16558, DSN 2026) found 833 vulnerable MCP servers in the wild, 18 of which had suspicious or deliberately misleading tool descriptions — a sign of intentional poisoning.

The Attack Surface

MCP’s security challenges span the entire protocol stack — from the tokens that authenticate requests, to the packages that deliver servers, to the prompts that guide agent behavior. Understanding the attack surface means understanding that every layer of the MCP architecture is a potential entry point. The major categories:

• Token and session hijacking. MCP servers often forward upstream-issued tokens without validating who the token was meant for (its ‘audience’) or what it claims, creating a path for control circumvention and data exfiltration. Session handles — the temporary identifiers that track an agent’s connection to a server — can be hijacked if they are not bound to a specific user or if they never expire. The ‘confused deputy’ problem is a recurring pattern: an agent with broad permissions is tricked into using those permissions on behalf of an attacker, like a receptionist who holds the master key being socially engineered into opening a restricted door.
• Supply chain compromise. MCP servers are distributed as packages through registries like npm and PyPI, making them vulnerable to the same supply-chain attacks that plague open-source software — but with higher stakes because the compromised package controls an agent’s access to production systems. Tool poisoning (manipulated tool descriptions that steer the model toward dangerous actions), tool shadowing (a server silently swapping tool definitions after trust is granted, like a bait-and-switch), and malicious MCP configuration files that trigger arbitrary command execution are all documented attack vectors.
• Prompt injection. Both direct prompt injection (an attacker sends malicious instructions to the agent) and indirect prompt injection (instructions are embedded in files, emails, or web pages that the agent later ingests as context) can coerce an agent into unauthorized actions. Insecure deserialization — when untrusted data is converted back into objects in a way that allows code execution — compounds the risk.
• Server-Side Request Forgery (SSRF). An attack where a server is tricked into making requests to unintended destinations. In MCP, an attacker who controls the OAuth or metadata URLs that an MCP client fetches can redirect those requests to internal network resources, cloud metadata endpoints (such as 169.254.169.254, which exposes cloud credentials), or other protected services. In stdio-based MCP transports — where the server runs as a local process — cross-site scripting (XSS) can escalate to host-level remote code execution, and stolen proxy tokens can enable unauthorized process spawning.
• Classic application security flaws. MCP servers are not immune to traditional web vulnerabilities: SQL injection, command injection, cross-site request forgery (CSRF), XML external entity (XXE) attacks, regular expression denial of service (ReDoS — where a crafted input causes the server’s pattern-matching engine to consume all available CPU), prototype pollution, and path traversal all apply. A survey of 2,614 MCP implementations found 82% had file-operation vulnerabilities prone to path traversal, and Astrix Security’s State of MCP Server Security 2025 found that only about 8.5% of MCP servers use OAuth.
• Excessive scope and permission creep. When MCP servers are granted broad, server-side privileges rather than user-bound scopes, a single compromise can cascade across every tool and resource the agent touches. Scopes tend to accumulate over time without regular review, a pattern known as permission creep — the digital equivalent of collecting keys you no longer need but never returning.

Documented Incidents

The theoretical risk is backed by real-world incidents:

• The ‘Mother of All AI Supply Chains’ (April 2026). OX Security disclosed a command-injection flaw in Anthropic’s official Python, TypeScript, Java, and Rust MCP SDKs. The vulnerability impacted at least 10 downstream projects — including LiteLLM, LangChain, LangFlow, Flowise, LettaAI, LangBot, LibreChat, DocsGPT, Bisheng, and Windsurf — and the Cloud Security Alliance’s research note on the disclosure identified 10 or more high or critical CVEs across affected implementations.
• CVE-2026-76404 (Splunk MCP Server, advisory August 2026). A critical vulnerability (CVSS 9.1 out of 10) in the Splunk MCP Server app’s credential management component allowed a user holding the Splunk admin role to execute arbitrary commands on the host operating system. The root cause was unsafe deserialization — the server converted stored data back into objects without validating its type, allowing an attacker to inject malicious code. Fixed in version 1.2.1.
• Flowise critical RCE (April 2026). CVE-2026-40933 let an authenticated attacker add an MCP stdio server carrying an arbitrary command and execute it on the host — ‘Due to unsafe serialization of stdio commands in the MCP adapter’ — in one of the most widely deployed open-source agent platforms; patched in version 3.1.0.
• MCPInspect research (DSN 2026). Academic researchers built a pre-integration scanner and found 833 vulnerable MCP servers, 18 with suspicious or misleading tool descriptions — suggesting deliberate attempts to poison agent behavior at the supply-chain level.
• Obot authorization bypass (May 2026). The MCP gateway endpoint /mcp-connect/{id} did not enforce access-control rules, letting any authenticated Obot user connect to and fully use any registered MCP server regardless of group membership (GHSA-vw82-7fv8-r6gp, CVSS 9.6); patched in version 0.21.1.
• Grafana MCP server-side request forgery (August 2026). CVE-2026-19516 (CVSS 9.1): the grafana_api_request tool accepted an X-Grafana-URL request header that let the caller control where the server’s outbound requests went — including internal, loopback, and metadata endpoints — and read the responses; fixed in version 1.1.0.
• LiteLLM MCP authentication bypass (added to CISA’s Known Exploited Vulnerabilities catalog September 2, 2026). CVE-2026-59822 let an unauthenticated attacker establish an authenticated MCP session using an arbitrary Bearer token through the MCP Streamable HTTP endpoint; it carries a September 16, 2026 remediation deadline, is the only KEV entry whose description names that endpoint, and is fixed in LiteLLM 1.84.0.
• MCP Python SDK credential redirection (September 2026). CVE-2026-115563: the SDK’s OAuth client did not validate the authorization-server issuer on every discovery path or bind stored credentials to their authorization server, so a malicious MCP server could redirect the client’s credentials to a token endpoint of its choosing; fixed in versions 1.30.0 and 2.2.0.

How to Defend Against It

Securing MCP-based infrastructure requires defense in depth. The official MCP Security Best Practices (modelcontextprotocol.io, July 2026) and the NSA’s cybersecurity guidance on MCP security design (May 2026) recommend:

• Validate tokens rigorously. Never accept client-supplied tokens as-is. Validate audience and claims, and bind session handles server-side to an authenticated user identifier.
• Restrict network exposure. Use egress proxies — intermediaries that enforce outbound traffic policy — to prevent SSRF. Restrict HTTP-transport MCP servers with authentication tokens, unix sockets, or restricted inter-process communication.
• Sandbox aggressively. Run local MCP servers in containers, chroot environments, or application sandboxes with minimal default privileges. Prefer stdio transport to limit network exposure.
• Enforce least privilege. Split read and write tools. Minimize scopes. Require explicit user consent per tool call where feasible. Review scopes regularly to prevent permission creep.
• Treat all input as untrusted. Sanitize tool metadata and parameters. Enforce integrity checks before tool-definition updates. Prevent secrets from entering model context or logs.
• Secure the supply chain. Pin versions. Scan code and dependencies. Require integrity and signature checks. Pre-scan servers before adding them to your agent’s tool set.
• Monitor and log. Centralized logging that ties prompts to tool calls and downstream actions enables incident response. Tool allowlists and output filtering for credentials add additional layers of guardrails.

Connection to Agentic AI Security

MCP Security is a critical subset of the broader AI agent security landscape. As agents become more autonomous, the protocols they use to interact with the world become the primary vectors for exploitation. The same trust-boundary challenges that make MCP a target — tool access, credential delegation, context ingestion — are the defining challenges of agent infrastructure security as a whole. Organizations deploying agents in production cannot treat MCP as a solved problem; it is a rapidly evolving attack surface that demands continuous monitoring, testing, and hardening.

Related Terms

See also Model Context Protocol (MCP), AI Agent, AI Agent Security, Prompt Injection, AI Supply Chain Security, Agent Exploitation, Sandbox Escape, Non-Human Identity (NHI), Guardrails.