AI has moved from answering questions to taking action.
Organizations are increasingly deploying AI agents that can access databases, interact with applications, retrieve files, execute code, create tickets, query cloud infrastructure, and perform other tasks on behalf of users.
Model Context Protocol, or MCP, makes those connections possible.
MCP provides a standardized way for AI applications and agents to connect with external tools, data sources, and services. Instead of building a different integration for every AI application and enterprise system, organizations can expose capabilities through MCP servers that agents can discover and use.
Enterprise AI now faces both enormous possibility and a new security challenge. The same connections that make an AI agent useful can also create another pathway to sensitive systems if the agent, MCP server, or interaction is compromised.
Security teams need to understand not only what MCP enables, but what needs to be secured as adoption grows.
What Is MCP?
At a basic level, MCP sits between an AI application and the tools or information it needs to complete a task. A simplified architecture might look like:
User → AI Agent → MCP Server → Enterprise Tool or Data
For example, an employee could ask an AI agent to investigate a software issue. Through MCP, the agent might be able to:
Search an internal knowledge base
Review a GitHub repository
Query a database
Look at an existing Jira ticket
Create a new ticket
Retrieve information from another enterprise application
MCP standardizes how AI applications discover and interact with those capabilities. Its consistency is one reason MCP has become increasingly important as enterprises deploy AI agents.
A key distinction exists between traditional AI applications and agents. A chatbot that produces an incorrect answer creates one type of risk. An agent that can take an incorrect action creates another.
Why MCP Changes the AI Security Conversation
Traditional applications generally execute predefined workflows. An AI agent uses natural-language instructions to determine which tool to use, when to use it, and what parameters to provide, introducing a new trust boundary.
Instead of simply asking, “Can this user access this application?” security teams must ask, “Should this agent be allowed to invoke this tool, with these permissions, using this information, under these circumstances?”
The more an agent can do, the greater the impact if that agent is misused.
Five MCP Security Risks Organizations Should Understand
MCP security encompasses several different problems. Some are familiar security problems appearing in a new environment, while others are more specific to how AI agents interpret context and select tools.
1. Shadow MCP Servers
Organizations cannot secure infrastructure they do not know exists.
Developers and employees can potentially configure agents to use MCP servers without going through traditional security review processes, creating the possibility of unauthorized or poorly secured MCP infrastructure connecting AI systems to enterprise resources.
For security teams, MCP discovery is becoming an important part of AI asset management.
Organizations need a clear view of their MCP environment, including how servers, agents, tools, data, and systems connect.
2. Excessive Permissions
An MCP connection is only as safe as the access behind it. If an agent has access to highly privileged tools or broadly scoped credentials, compromise or manipulation of that agent can have a much larger impact.
An agent that can read one knowledge base presents a different level of risk from an agent capable of reading production databases, modifying cloud infrastructure, and sending external communications.
Organizations should treat agent permissions with the same rigor they apply to human and machine identities.
3. Prompt Injection
One of the more unusual characteristics of AI security is that data can sometimes influence behavior.
For example, if an agent reads a webpage, document, email, or ticket containing malicious instructions, the model could interpret some of that content as direction and act on it.
If the same agent also has access to powerful MCP tools, the consequences become much more significant, raising the risk that someone could influence the AI to take an action it shouldn’t.
4. Tool Poisoning
MCP introduces another interesting attack technique: tool poisoning.
When an MCP client connects to a server, the server describes the tools it exposes, helping the AI understand what each tool does and when to use it.
A malicious or compromised server can manipulate that mechanism. MCP tool poisoning is an indirect prompt-injection technique where malicious instructions embedded in MCP tool information influence the agent’s behavior. The result could include calling restricted tools, accessing sensitive information, or sending data somewhere it should not go.
An approved connection does not automatically mean every future interaction through that connection should be trusted. Security controls need to extend beyond installation and authorization into runtime activity.
5. Compromised Agents Becoming an Attack Path
MCP connects AI to the rest of the enterprise, meaning an MCP security incident may not stay confined to MCP.
If an agent is manipulated into retrieving a credential, that credential could then be used to access a cloud environment. The attacker could create infrastructure, compromise another identity, access data, or move deeper into the organization.
The attack might begin with an AI interaction, but the consequences quickly become familiar to any SOC, making it important for organizations to think about MCP security as part of a broader enterprise security architecture.
What Does an MCP Security Architecture Look Like?
A useful way to think about MCP security is through five capabilities:
Discover
Organizations need visibility into MCP servers, agents, tools, and connections operating within the environment.
Govern
Security teams need policies defining which users and agents are allowed to access particular MCP servers, resources, and tools.
Protect
Organizations should inspect interactions, enforce least privilege, and stop dangerous or unauthorized activity before sensitive tools execute.
Detect
Organizations need to identify abnormal agent behavior, unusual tool usage, and suspicious activity that could indicate compromise or abuse.
Respond
When suspicious MCP activity leads to broader malicious behavior, security teams still need to investigate the attack, understand its scope, and contain it across the enterprise.
MCP Security Doesn’t End at MCP
Organizations must secure the connection between AI agents and enterprise tools.
MCP creates another pathway into the same enterprise security environment organizations already defend. Security teams need visibility on both sides of the equation: what happened inside the AI interaction, and what happened across the enterprise because of it.
As organizations give AI agents greater autonomy, both questions will increasingly become part of the same investigation.
MCP makes it easier for AI to interact with the enterprise. Security teams need to make sure increased connectivity does not create new opportunity for attackers.
