MCP security is the practice of discovering, assessing, and controlling Model Context Protocol servers that connect AI systems to enterprise tools and data. Learn the risks, controls, and governance model.
MCP security is the practice of discovering, assessing, and controlling Model Context Protocol (MCP) servers in an organization. MCP is an open standard that lets AI models connect to external tools and data sources, such as file systems, databases, email, and SaaS applications.
Each MCP server an employee installs extends what an AI can see and do, which makes unmanaged MCP servers one of the fastest-growing and least visible sources of enterprise AI risk.
The Model Context Protocol, introduced by Anthropic in late 2024 and since adopted across the AI industry, standardizes how AI applications call external capabilities. An MCP server exposes tools (actions the AI can take), resources (data the AI can read), and prompts to any MCP-compatible client, such as Claude, AI-powered IDEs, or agent frameworks. Instead of every AI product building custom integrations, one MCP server for, say, a Postgres database or a GitHub account works with every compliant client.
That interoperability is exactly what creates the security problem. MCP makes it trivial for any employee to hand an AI model live access to real systems, and thousands of community-built MCP servers of varying quality and provenance are freely available to install.
They are an unvetted supply chain. Most MCP servers are open-source projects installed from public registries with no security review. A malicious or compromised server sits directly in the path between an AI model and enterprise data, able to read everything that flows through it.
They hold real credentials. An MCP server for email holds mail credentials; one for a database holds connection strings. These secrets often reside in plaintext config files on employee laptops, outside any secrets management process.
They inherit broad permissions. Like AI agents, MCP servers typically run with the full permissions of the user who configured them. A server that's meant to let an AI read a single project folder frequently has access to the entire drive.
They enable prompt injection with consequences. When an AI connected to MCP tools reads malicious content, injected instructions can trigger real actions, such as exfiltrating files, sending messages, or modifying records via the server's tools. Documented attack patterns include tool poisoning, in which a server's tool descriptions contain hidden instructions for the model, and rug pulls, in which a server behaves benignly until an update changes its behavior.
They are invisible to standard tooling. MCP servers are lightweight local processes or remote endpoints. They do not appear in SaaS admin consoles, and traditional CASB and DLP tools have no concept of them.
MCP security follows the same discover-assess-control sequence as the rest of enterprise AI security, applied to a new asset class:
They overlap but cover different layers. Agent security governs the acting AI system: its goals, autonomy, and identity. MCP security governs the connective tissue: the servers that give any AI, agent, or not, access to tools and data. A single MCP server can serve many agents and applications, so one over-permissioned or malicious server multiplies risk across every AI that uses it. Mature programs treat MCP servers as first-class assets in the AI inventory, alongside apps, agents, and models.
Manually, rarely; MCP servers leave no trail in procurement or SaaS admin panels. Detection relies on correlating endpoint telemetry (MCP client configurations and server processes on managed devices) with network signals (traffic to remote MCP endpoints) and cloud data. This is the approach purpose-built AI security platforms take. AIBound discovers MCP servers alongside AI apps, agents, and models across browser, endpoint, network, and cloud telemetry, maps the identities and data each server can access, and grades its risk from A to F, so security teams can sanction useful servers and shut down dangerous ones.
What does MCP stand for in security? Model Context Protocol is the open standard that connects AI models to external tools and data sources. MCP security is the discipline of managing the risk that those connections create.
Are MCP servers safe to use? Official servers from established vendors, configured with scoped credentials, are reasonably safe. The risk lies in unvetted community servers, plaintext secrets, and overly broad permissions. Safety is a property of how a server is sourced and configured, not of MCP itself.
What is tool poisoning in MCP? Tool poisoning is an attack where an MCP server embeds hidden instructions in its tool descriptions. The AI model reads those descriptions to decide how to use the tools, so hidden instructions can manipulate the model into leaking data or misusing other tools.
Can firewalls or CASBs detect MCP servers? Not reliably. MCP servers often run as local processes with no network signatures that a CASB recognizes, and remote MCP traffic appears as generic API calls. Detection requires correlating endpoint configuration data with network telemetry, which is what AI-specific discovery platforms are built to do.
Should companies ban MCP servers? Blanket bans sacrifice significant productivity, especially for developers, and push usage underground. The stronger position is an allowlist: discover what is in use, sanction official and reviewed servers with scoped credentials, and block the rest.