Get Early Access
HomeSecurityMCP Security Risks and Attacks

AI AGENT SECURITY THREAT

What are the main MCP security risks?

MCP can connect AI agents to powerful tools, data, and enterprise systems. Those connections also create new trust relationships, credential paths, permission boundaries, and attack surfaces that security teams need to understand.

Explore MCP SecurityExplore Runtime Security
MCP TRUST CHAIN CONCEPTUAL VIEW · SYNTHETIC
AGENT↓
MCP SERVER↓
TOOL↓
CREDENTIAL↓
ENTERPRISE SYSTEM↓
DATA / ACTION
Trust can fail at every layerRuntime impact matters

THE DEFINITION

MCP security risks are risks in the connection path.

MCP security risks are weaknesses or unsafe trust relationships introduced when AI agents connect to external tools, data, and services through Model Context Protocol. Risks can include malicious or compromised MCP servers, manipulated tool content, excessive permissions, credential misuse, unsafe tool actions, and sensitive data exposure.

  • MCP can expand what an agent is able to do.
  • Tools may operate with downstream credentials.
  • Descriptions and output can influence agent behavior.
  • Third-party servers introduce external trust.
  • Overprivileged tools increase blast radius.
  • Runtime policy can reduce unsafe-action impact.

THE TRUST CHAIN

Where does trust exist in an MCP connection?

MCP connects more than context. It can connect authority.

AGENTWhich agent is acting?
MCP SERVERWho operates it?
TOOLWhat capability does it expose?
CREDENTIALWhat authority sits behind it?
SYSTEMWhat can it reach?
ACTIONWhat can actually happen?

MAIN RISKS

What are the main MCP security risks?

Malicious or compromised serverServer behavior differs from what users or agents expect.
Tool poisoningTool descriptions or metadata influence agent behavior unsafely.
Indirect prompt injectionTool output or resources contain malicious instructions.
Excessive tool permissionsThe agent receives capabilities beyond its task.
Overprivileged credentialsDownstream identities expose unnecessary authority.
Tool misuseA legitimate MCP tool is used in an unsafe context.
Data exposureSensitive information becomes reachable through tools.
Third-party trustExternal operators or dependencies create new boundaries.
Shadow MCPSecurity teams do not know which servers are in use.
Multi-tool attack chainsSeveral legitimate calls combine into an unsafe outcome.

SERVER COMPROMISE

What is a malicious or compromised MCP server?

A malicious or compromised MCP server may expose tools or content that behaves differently than the agent or user expects.

Potential risks include misleading capabilities, manipulated output, unexpected data access, external transfer, hidden side effects, and altered tool behavior.

Treat MCP servers as security-sensitive infrastructure, not passive connectors.

SERVER BEHAVIOR
Expected capabilityReview
Returned contentMust be understood
Downstream accessMust be understood
Side effectsMust be understood

TOOL POISONING

What is MCP tool poisoning?

Tool poisoning occurs when information associated with a tool is manipulated in a way that changes how an AI agent understands or uses that tool.

Explore Tool Misuse
Tool nameDescriptionParametersMetadataReturned content

INDIRECT PROMPT INJECTION

MCP output can become an indirect prompt injection path.

The connection may be trusted while the content returned through it is still untrusted.

A trusted MCP connection does not make every returned instruction trustworthy.

Indirect Prompt Injection Prompt Injection
MCP TOOL↓UNTRUSTED OUTPUT↓AGENT / NEXT DECISION↓PRIVILEGED TOOL CALL↓SENSITIVE SYSTEM

TOOL PERMISSIONS

An MCP server can expose more capability than the agent needs.

Tool availability itself is part of the permission boundary.

Explore Overprivileged Agents Explore Excessive Agency
AGENT TASK: LOOK UP INVOICE STATUS
Read InvoiceNEEDED
Modify InvoiceEXPOSED CAPABILITY
Issue RefundEXPOSED CAPABILITY
Export CustomerEXPOSED CAPABILITY
Delete InvoiceEXPOSED CAPABILITY

DOWNSTREAM CREDENTIALS

The agent may exercise authority it does not directly hold.

The agent may never receive the credential directly. But if it can invoke the tool, it can effectively exercise that credential’s permissions.

Effective agent access includes permissions exercised indirectly through MCP tools.

Explore Agent Identity & Permissions
AGENT↓MCP TOOL↓SERVICE ACCOUNT↓ADMIN ROLE↓PRODUCTION SYSTEM

TOOL MISUSE

A trusted MCP tool can still be used unsafely.

The server is legitimate. The tool is legitimate. The action is inappropriate for the task.

The tool does not need to be malicious for the action to be unsafe.

Explore Tool Misuse
TASKCheck order status↓TOOL USEDExport all ordersLegitimate tool. Wrong action.

THIRD-PARTY TRUST

Third-party MCP servers create external trust dependencies.

Third-party does not automatically mean unsafe. It means the trust boundary should be explicit.

  • Who operates the server?
  • Where is it hosted?
  • What data does it process?
  • What tools does it expose?
  • What credentials does it use?
  • What systems can it reach?
  • How is it updated?
  • Who owns the relationship internally?

SHADOW MCP

What is shadow MCP?

Shadow MCP refers to MCP servers or connections used inside an organization without full security visibility, ownership, inventory, or review.

You cannot secure MCP infrastructure you do not know exists.

Explore Agent Discovery
Developer experimentationOpen-source serversLocal toolsSaaS integrationsAutomationProductivity workflows

DATA EXPOSURE

MCP can create new paths to sensitive data.

Security teams should understand both inbound data access and outbound movement.

Explore Data Exfiltration
INBOUNDAgent → MCP Tool → Internal System → Sensitive Data
OUTBOUNDSensitive Data → Agent → MCP Tool → External Destination

MULTI-TOOL CHAINS

Risk can emerge across several MCP tool calls.

Each call may look legitimate. Together they may create an unsafe outcome.

Agentic risk can exist in the sequence rather than in a single tool.

01Query internal database
02Generate report
03Create file
04Upload file
05Send external link
Potential data-exfiltration path

ALTERNATE PATHS

Blocking one tool may not block the outcome.

Controls should consider the outcome, sequence, destination, and context—not only an individual tool name.

DIRECT EXPORTBlocked
or
ALTERNATE PATHQuery → Generate → Upload

AUTHORIZATION

Authentication does not mean every MCP action is allowed.

AUTHENTICATIONWho or what is connecting?
AUTHORIZATIONWhat is that identity allowed to do?
RUNTIME POLICYShould this action happen now?

Authenticated does not mean automatically approved.

Explore Runtime Security

RUNTIME MCP SECURITY

Evaluate sensitive MCP actions before they execute.

Runtime context can include the agent, identity, tool, parameters, resource, data sensitivity, destination, environment, task, and autonomy.

Explore Runtime Security
CONCEPTUAL EXAMPLE
AGENTFinance Agent
MCP TOOLExport Accounts
IDENTITYfinance-service
RESOURCECustomer financial data
DESTINATIONExternal system
DECISIONBLOCK

HUMAN APPROVAL

Some MCP actions should require human review.

Not every action needs review. Higher-impact actions may need a person in the loop.

ILLUSTRATIVE EXAMPLEFinance Agent → Issue Payment
AMOUNT$75,000
CREDENTIALpayment-service
DECISIONREVIEW

TRUST CLASSIFICATION

Not every MCP connection deserves the same trust.

This is a conceptual model, not an automated Eyrane trust score.

APPROVEDKnown ownerReviewed tools and managed credentials
RESTRICTEDElevated capabilitiesAdditional policy required
UNREVIEWEDIncomplete contextUnknown or missing security information
BLOCKEDExplicitly disallowedConnection or action is not permitted

ATTACK PATH

Follow the path from untrusted output to sensitive action.

Security controls should reduce the impact even when content or behavior at an earlier layer is manipulated.

UNTRUSTED MCP OUTPUT↓
AGENT INTERPRETS CONTENT↓
PRIVILEGED TOOL SELECTED↓
DOWNSTREAM CREDENTIAL USED↓
SENSITIVE SYSTEM ACCESSED↓
RUNTIME POLICY↓
BLOCK / REVIEW

MITIGATION

How to reduce MCP security risk.

01Inventory MCP serversKnow what exists.
02Assign ownershipKnow who owns each connection.
03Review toolsUnderstand every exposed capability.
04Map credentialsIdentify the identity behind each tool.
05Apply least privilegeLimit tools and downstream permissions.
06Treat output as untrustedDo not grant returned content instruction authority automatically.
07Control high-impact actionsApply runtime policy.
08Require approval where appropriateKeep people in the loop for sensitive actions.
09Protect sensitive dataUnderstand sources and destinations.
10Segment environmentsSeparate development and production access.
11Red team MCP pathsTest manipulated output and multi-step behavior.
12Maintain auditabilityRecord tool use and outcomes.

ADVERSARIAL TESTING

Test MCP trust before production.

Test manipulated descriptions and output, untrusted servers, excessive permissions, data movement, approval bypass, and multi-tool chains.

Explore AI Red Teaming
Which server was involved?Which tool was invoked?Which credential enabled it?Which system was reached?What action happened?Did runtime policy intervene?

AUDITABILITY

Trace actions across the full MCP path.

Security teams should be able to connect the initiating agent, server, tool, downstream identity, affected system, data movement, policy, approval, and outcome.

ILLUSTRATIVE TIMELINE
15:04:12Query AccountALLOW
15:04:19Export AccountsREVIEW
15:05:02Approval deniedSTOPPED

FROM MCP RISK TO CONTROL

Reduce MCP risk across the connection path.

01DiscoverFind servers, tools, and connected agents.
↓
02UnderstandMap credentials, permissions, and downstream access.
↓
03ControlApply policy before sensitive actions execute.
MCP Security Agent Identity & Permissions Runtime Security

AUTHORITATIVE GUIDANCE

Related MCP and AI security guidance.

These primary resources provide shared language for MCP security, agentic threats, AI risk, and adversarial techniques. They do not imply endorsement of Eyrane.

OFFICIAL MCP GUIDANCESecurity best practices for MCP.OWASP AGENTIC AIAgentic AI threats and mitigations.NIST AI RMFAI risk management guidance.MITRE ATLASAdversarial tactics and techniques for AI systems.

COMMON QUESTIONS

Questions about MCP attacks.

What are MCP security risks?

MCP security risks are weaknesses or unsafe trust relationships introduced when AI agents connect to tools, data, and services through Model Context Protocol.

Is MCP secure?

MCP is a connection protocol, not a complete security boundary. Security depends on the server, tool, credential, permissions, content, and actions connected through it.

What is an MCP server attack?

An MCP server attack involves malicious, compromised, or unexpectedly behaving server infrastructure that exposes an agent to unsafe tools, content, data access, or downstream actions.

What is MCP tool poisoning?

MCP tool poisoning is manipulation of tool descriptions, metadata, parameters, or output so an agent misunderstands or uses a capability unsafely.

Can MCP cause prompt injection?

Yes. Tool output or resources can contain untrusted instructions that influence an agent’s next decision, creating an indirect prompt injection path.

Can MCP tools expose sensitive data?

Yes. MCP tools may read, transform, export, or send data through the identities and systems behind them.

How do MCP tools use credentials?

An MCP tool may act through a service account, OAuth token, cloud role, or another downstream identity even when the agent does not directly hold that credential.

What is shadow MCP?

Shadow MCP refers to MCP servers or connections used without complete security visibility, ownership, inventory, or review.

Can an MCP server make an AI agent overprivileged?

Yes. A server can expose more tools or downstream authority than the agent’s task requires, increasing its effective permissions and blast radius.

How should companies secure third-party MCP servers?

Companies should identify the operator, hosting, tools, data flows, credentials, reachable systems, update process, and internal owner before granting trust.

Should MCP tool output be trusted?

No. A trusted connection does not make every returned instruction trustworthy. Tool output should be treated according to its source and context.

How can runtime security protect MCP actions?

Runtime security evaluates the agent, identity, tool, resource, data, destination, environment, and task before allowing, reviewing, or blocking a sensitive action.

How should organizations red team MCP?

Red teams should test manipulated tool descriptions and output, untrusted servers, excessive permissions, data movement, approval bypass, and multi-tool chains.

RELATED SECURITY

Continue exploring MCP and agent security.

MCP Security Agent Discovery Agent Identity & Permissions Runtime Security AI Red Teaming What is MCP Security? What is AI Agent Security? What is Agentic Security? Prompt Injection Indirect Prompt Injection Excessive Agency Overprivileged Agents Tool Misuse Data Exfiltration

MCP SECURITY RISKS

Secure every path from MCP connection to enterprise action.

Understand the servers, tools, identities, permissions, and data behind agent actions — and control high-impact behavior before it reaches enterprise systems.

Explore MCP SecurityGet Early Access