MCP Security

Why It Matters

The Model Context Protocol is the connective tissue between AI agents and the outside world. When an agent needs to read a database, send an email, call an API, or modify a file, it does so through an MCP server. That makes MCP servers a single point of leverage: compromise one, and you inherit every tool and credential the agent can reach.

The scale of exposure is not theoretical. In April 2026, security firm OX Security disclosed a systemic architectural flaw in Anthropic’s official MCP SDKs — the reference implementations that most MCP servers are built on. The flaw was estimated to expose roughly 200,000 vulnerable instances across a supply chain of over 150 million package downloads. The Cloud Security Alliance described MCP as ‘one of the most rapidly weaponized attack surfaces in agentic AI deployments.’ Academic research from the MCPInspect study (arXiv 2510.16558, DSN 2026) found 833 vulnerable MCP servers in the wild, 18 of which had suspicious or deliberately misleading tool descriptions — a sign of intentional poisoning.

The Attack Surface

MCP’s security challenges span the entire protocol stack — from the tokens that authenticate requests, to the packages that deliver servers, to the prompts that guide agent behavior. Understanding the attack surface means understanding that every layer of the MCP architecture is a potential entry point. The major categories:

• Token and session hijacking. MCP servers often forward upstream-issued tokens without validating who the token was meant for (its ‘audience’) or what it claims, creating a path for control circumvention and data exfiltration. Session handles — the temporary identifiers that track an agent’s connection to a server — can be hijacked if they are not bound to a specific user or if they never expire. The ‘confused deputy’ problem is a recurring pattern: an agent with broad permissions is tricked into using those permissions on behalf of an attacker, like a receptionist who holds the master key being socially engineered into opening a restricted door.
• Supply chain compromise. MCP servers are distributed as packages through registries like npm and PyPI, making them vulnerable to the same supply-chain attacks that plague open-source software — but with higher stakes because the compromised package controls an agent’s access to production systems. Tool poisoning (manipulated tool descriptions that steer the model toward dangerous actions), tool shadowing (a server silently swapping tool definitions after trust is granted, like a bait-and-switch), and malicious MCP configuration files that trigger arbitrary command execution are all documented attack vectors.
• Prompt injection. Both direct prompt injection (an attacker sends malicious instructions to the agent) and indirect prompt injection (instructions are embedded in files, emails, or web pages that the agent later ingests as context) can coerce an agent into unauthorized actions. Insecure deserialization — where untrusted data is converted back into objects in a way that allows code execution — compounds the risk.
• Server-Side Request Forgery (SSRF). SSRF is an attack where a server is tricked into making requests to unintended destinations. In MCP, an attacker who controls the OAuth or metadata URLs that an MCP client fetches can redirect those requests to internal network resources, cloud metadata endpoints (such as 169.254.169.254, which exposes cloud credentials), or other protected services. In stdio-based MCP transports — where the server runs as a local process — cross-site scripting (XSS) can escalate to host-level remote code execution, and stolen proxy tokens can enable unauthorized process spawning.
• Classic application security flaws. MCP servers are not immune to traditional web vulnerabilities: SQL injection, command injection, cross-site request forgery (CSRF), XML external entity (XXE) attacks, regular expression denial of service (ReDoS — where a crafted input causes the server’s pattern-matching engine to consume all available CPU), prototype pollution, and path traversal all apply. Research indicates that approximately 82% of MCP servers are vulnerable to path traversal, and only about 8.5% implement OAuth for authentication.
• Excessive scope and permission creep. When MCP servers are granted broad, server-side privileges rather than user-bound scopes, a single compromise can cascade across every tool and resource the agent touches. Scopes tend to accumulate over time without regular review, a pattern known as permission creep — the digital equivalent of collecting keys you no longer need but never returning.

Documented Incidents

The theoretical risk is backed by real-world incidents:

• The ‘Mother of All AI Supply Chains’ (April 2026). OX Security disclosed a command-injection flaw in Anthropic’s official Python, TypeScript, Java, and Rust MCP SDKs. The vulnerability impacted more than 10 downstream projects — including LiteLLM, LangChain, LangFlow, Flowise, LettaAI, LangBot, LibreChat, DocsGPT, Bisheng, and Windsurf — and produced over 30 responsible disclosures with at least seven confirmed high or critical CVEs.
• CVE-2026-76404 (Splunk MCP Server). A critical vulnerability (CVSS 9.1 out of 10) in the Splunk MCP Server app’s credential management component allowed a user holding the Splunk admin role to execute arbitrary commands on the host operating system. The root cause was unsafe deserialization — the server converted stored data back into objects without validating its type, allowing an attacker to inject malicious code. Fixed in version 1.2.1.
• Flowise critical RCE (April 2026). A remote code execution vulnerability in Flowise — one of the most widely deployed open-source agent platforms — required emergency patching across hundreds of production deployments.
• MCPInspect research (DSN 2026). Academic researchers built a pre-integration scanner and found 833 vulnerable MCP servers, 18 with suspicious or misleading tool descriptions — suggesting deliberate attempts to poison agent behavior at the supply-chain level.

How to Defend Against It

Securing MCP-based infrastructure requires defense in depth. The official MCP Security Best Practices (modelcontextprotocol.io, July 2026) and NSA/CSI guidance (June 2026) recommend:

• Validate tokens rigorously. Never accept client-supplied tokens as-is. Validate audience and claims, and bind session handles server-side to an authenticated user identifier.
• Restrict network exposure. Use egress proxies — intermediaries that enforce outbound traffic policy — to prevent SSRF. Restrict HTTP-transport MCP servers with authentication tokens, unix sockets, or restricted inter-process communication.
• Sandbox aggressively. Run local MCP servers in containers, chroot environments, or application sandboxes with minimal default privileges. Prefer stdio transport to limit network exposure.
• Enforce least privilege. Split read and write tools. Minimize scopes. Require explicit user consent per tool call where feasible. Review scopes regularly to prevent permission creep.
• Treat all input as untrusted. Sanitize tool metadata and parameters. Enforce integrity checks before tool-definition updates. Prevent secrets from entering model context or logs.
• Secure the supply chain. Pin versions. Scan code and dependencies. Require integrity and signature checks. Pre-scan servers before adding them to your agent’s tool set.
• Monitor and log. Centralized logging that ties prompts to tool calls and downstream actions enables incident response. Tool allowlists and output filtering for credentials add additional layers of guardrails.

Connection to Agentic AI Security

MCP Security is a critical subset of the broader AI agent security landscape. As agents become more autonomous, the protocols they use to interact with the world become the primary vectors for exploitation. The same trust-boundary challenges that make MCP a target — tool access, credential delegation, context ingestion — are the defining challenges of agent infrastructure security as a whole. Organizations deploying agents in production cannot treat MCP as a solved problem; it is a rapidly evolving attack surface that demands continuous monitoring, testing, and hardening.

Related Terms

See also Model Context Protocol (MCP), AI Agent, AI Agent Security, Prompt Injection, AI Supply Chain Security, Agent Exploitation, Sandbox Escape, Non-Human Identity (NHI), Guardrails.