MCP security is the practice of protecting AI agents that use the Model Context Protocol (MCP), an open standard for connecting large language models to external tools and data, from attacks that abuse those connections. The main risks are tool poisoning, prompt injection through tool descriptions and results, and rogue or over-permissioned MCP servers, and the core problem is that an MCP-connected agent trusts the tools it is given as much as the user who gave them. As MCP becomes the default way agents like Claude, Cursor, and Amazon Kiro reach the outside world, its security has moved from niche to essential.

Understanding what MCP security means starts with what MCP does. Introduced by Anthropic and now widely adopted, MCP lets an AI agent discover and call tools exposed by MCP servers, each described in natural language so the model knows when to use them. That natural-language trust is the crux: the same channel that tells the agent what a tool does can also carry instructions the agent obeys, which is why MCP inherits the whole family of prompt-injection problems.

What are the main MCP security risks?

The risks cluster around trust: the agent trusts tool descriptions, tool results, and the servers themselves. Each is a place an attacker can inject.

Tool poisoning is the signature MCP attack: because the agent reads a tool's description to decide how to use it, a hidden instruction in that description can steer the model before the tool is ever called.

How does prompt injection work through MCP?

Through the same channel that makes MCP useful. When an agent reads a tool description or a tool's returned data, any embedded instruction becomes part of what it may act on, so an attacker who controls an MCP server, or the content a tool returns, can tell the agent to exfiltrate secrets or misuse other tools. Real cases show the pattern: researchers have demonstrated instructions split across an MCP tool description and its result so an agent stitches them together, and Amazon Kiro was shown exfiltrating local data after opening a crafted workspace that shipped MCP configuration. The lesson is consistent, an MCP-connected agent treats its tools as trusted context, and that trust is the attack surface.

How do you use MCP tools safely?

Treat MCP servers and their outputs as untrusted input, and constrain the agent around them. In practice that means connecting only MCP servers you trust and have reviewed, applying least privilege so an agent can reach only the tools and data it needs, isolating untrusted content, requiring human approval for high-impact actions, and monitoring what agents actually do. Because a single connected server can carry hidden instructions, the safest posture assumes any tool can be poisoned and limits the blast radius accordingly.

Frequently asked questions

Is MCP itself insecure? No, MCP is a protocol. The risks come from how agents trust tools and from malicious or over-permissioned servers, not from a flaw in the standard itself.

What is tool poisoning? Hiding malicious instructions in an MCP tool's description or metadata so the agent is influenced before or during tool use, a form of indirect prompt injection.

Does MCP need a CVE to be dangerous? No. Most MCP attacks are design-level abuses of trust rather than discrete software bugs, so they often carry no CVE.

Our read

MCP is the connective tissue of the agent era, and its security reduces to a single hard truth: an agent trusts the tools you connect as much as it trusts you. That makes tool selection and least privilege security decisions, not configuration details. The verifiable-by-design approach treats every MCP server as untrusted until proven otherwise and measures what a poisoned tool could actually reach, which is exactly the kind of assumption supervised adversary simulation is built to test. Connect deliberately, scope tightly, and verify the blast radius before an agent touches real secrets.

Protocol detail per Anthropic MCP; risk classes per OWASP GenAI and NIST AI RMF. Sources linked above.

Related: What is prompt injection? and Amazon Kiro prompt injection.