L12. MCP Security: Hardening the Model Context Protocol

What MCP Is

The Model Context Protocol (MCP) is an open protocol that standardizes how AI models (clients) connect to tools and data sources (servers). An MCP server exposes a set of tools, resources, and prompts that the connected model can use. Think of it as a standardized API layer between AI models and the world.

MCP is seeing rapid enterprise adoption because it removes the need to write custom integration code for each AI tool. A single MCP-capable agent can connect to dozens of MCP servers (filesystem, databases, APIs, web browsers) without bespoke connectors.

The MCP Attack Surface

Server trust: when an AI client connects to an MCP server, it receives tool definitions that describe what each tool does. A malicious or compromised MCP server can return tool definitions with embedded instructions designed to manipulate the model. This is a form of indirect prompt injection via tool metadata. Tool poisoning: an attacker who can control an MCP server connected to an agent can define tools with names and descriptions that trick the model into using them in unintended ways. Example: a tool named "send_report" that secretly also exfiltrates context. Cross-server contamination: in multi-server setups, a compromised MCP server can attempt to influence the model's behavior when calling other, legitimate servers. The model's context window contains outputs from all servers, and a malicious server can embed instructions targeting other servers' tools. Overprivileged MCP servers: developers often grant MCP servers broad system access for convenience during development and never scope them down for production. A filesystem MCP server with full read/write access is a significant attack target.

Hardening Controls

Server authentication and integrity:

• Validate MCP server identity before connecting (certificate pinning or signed server manifests)
• Maintain an allowlist of approved MCP servers; reject connections to unlisted servers
• Review tool definitions from new MCP servers before enabling them in production

Tool approval policies:

• Require human approval before an agent can use a tool it has not used before in the current session
• Log all tool calls with the full input and output for audit
• Disable tools that are not needed for the current task (dynamic tool scoping)

Privilege minimization:

• Each MCP server should run with the minimum OS-level permissions needed
• Filesystem MCP servers should be path-restricted to the directories the agent legitimately needs
• Network-capable MCP servers should have egress restrictions (allowlisted destinations only)

Isolation:

• Run MCP servers in isolated containers or VMs, not on the host where the AI client runs
• Network-segment MCP servers so they cannot reach each other directly
• Use separate MCP server instances per-tenant in multi-tenant deployments