Model Context Protocol (MCP): Security Risks and Best Practices

Model Context Protocol (MCP) is changing how AI systems connect to business tools, data sources, and applications. Instead of only generating text, AI agents can use MCP connections to read files, query databases, call APIs, and trigger workflows.

That makes MCP useful for enterprise AI adoption. It also makes MCP security a priority.

When MCP servers connect AI agents to sensitive data and external tools, they become control points for access, identity, permissions, logging, and response. Without the right safeguards, a helpful AI workflow can quickly become a security risk.

What is Model Context Protocol (MCP)?

Model Context Protocol is an open standard used to connect AI applications to external tools and data sources. In simple terms, MCP gives AI agents a more consistent way to request context, call approved tools, and use enterprise systems.

For example, an AI agent may need to search an internal knowledge base, check a customer record, summarize a document, update a ticket, or retrieve data from a business application. MCP provides a structured way for the AI system to interact with those resources through approved connections.

That means an MCP server with broad tool access can expand the blast radius of prompt injection, credential theft, over-permissioning, or agent misuse. If an attacker can influence an AI agent or compromise an MCP connection, the risk may extend into the systems, data, and actions exposed through that server.

How Do MCP Servers Work?

MCP architecture typically includes four core parts: the AI application or host, the MCP client, the MCP server, and the connected tools or services.

• AI application or MCP host – Runs the AI interface or agent. It receives the user’s task and decides when external context or tools are needed. 
• MCP client – Sends structured requests from the AI application to the right MCP server and returns the server’s response back to the agent.
• MCP server – Acts as the controlled bridge between the AI system and external resources. It exposes approved tools, data, or actions for the agent to use. 
• Connected resources – May include databases, file systems, email security tools, ticketing systems, cloud services, business applications, or APIs.

A typical MCP interaction follows this flow:

Importance of MCP for Enterprises

MCP can make AI systems more practical for enterprise use. Instead of relying only on static model knowledge or pasted user prompts, agents can interact with live systems and relevant business context.

That creates new value. It also raises the stakes.

A simple chatbot may answer a question incorrectly. An agent connected through MCP may retrieve sensitive information, call an API, edit a record, trigger a workflow, or send data to another system. The risk increases when agents can access internal data, use external tools, or complete actions without strong security controls.

This is why MCP servers should be treated as trust boundaries. They are not just developer plumbing. They are control points where organizations should enforce identity, permission, tool, session, and logging requirements.

Main MCP Server Security Risks

MCP security risks often come from access, identity, credential, and tool-control failures. The following areas deserve close review during any MCP implementation or MCP deployment.

Tool Poisoning

Tool poisoning happens when attackers manipulate tool descriptions, parameters, metadata, defaults, or prompts exposed through MCP servers. Because AI agents rely on tool descriptions to decide what a tool does and when to use it, malicious or misleading instructions can influence agent behavior.

For example, a tool description could be altered to make an agent send data to the wrong destination, ignore normal validation, or choose a risky action. This attack vector is especially concerning because malicious instructions may appear inside metadata rather than in a visible user prompt.

Confused Deputy Authorization Failures

A confused deputy issue occurs when an MCP server executes actions using its own elevated permissions instead of the requesting user’s approved permissions.

In practice, this means the AI agent may cause a server to perform actions the user could not normally perform. If the server has broad access to enterprise systems, the result can include unauthorized actions, data exposure, or changes made under the wrong identity.

Tool Shadowing and Tool Name Collision

Tool shadowing happens when a malicious MCP tool imitates a legitimate one. It may use a similar name, description, or function so an agent selects the wrong tool.

This can occur when multiple MCP servers expose overlapping tools. For example, a legitimate “search customer record” tool and a malicious “search_customer_records” tool may appear similar to the agent. Without tool validation and clear naming controls, the AI system may call the unsafe option.

Excessive Permissions

MCP servers create risk when they expose more tools, data, or actions than the approved use case requires. A support agent may only need to read ticket history, but the server may also expose customer exports, administrative actions, or billing data.

Excessive permissions make every mistake more damaging. They also give attackers more options if they compromise an MCP connection or influence agent behavior through prompt injection.

Weak Authentication

Poor authentication can allow unauthorized users, agents, or services to connect to MCP servers. This risk becomes more serious when MCP servers are reachable from public networks, untrusted clients, or unmanaged environments.

Strong authentication should apply to users, agents, services, and machine identities. Security teams should also review how trust is established between the MCP host, MCP client, and server.

Broad OAuth Scopes

Broad OAuth scopes can grant wide application permissions when narrower scopes would support the same task. For example, an agent may only need read-only access to a specific folder, but the integration may request full access to an entire drive or mailbox.

This increases the potential impact of compromise. Securing MCP servers should include reviewing scopes and limiting access to the minimum needed for each workflow.

Token Passthrough and Long-Lived API Keys

Token passthrough can expose credentials when user or service tokens move through the MCP flow without strong controls. If tokens are forwarded, logged, stored, or reused improperly, attackers may gain access beyond the original session.

Long-lived API keys create similar problems. Persistent keys can be stolen, reused, or forgotten, especially when stored in code, logs, local files, or unmanaged developer environments. Secure token handling should avoid hardcoded secrets, unmanaged service accounts, and unnecessary credential exposure.

Machine Identity Misuse

MCP servers often rely on service accounts, API tokens, certificates, or other machine identities. Attackers may target these identities because they can provide stable access to enterprise systems.

A security team should treat machine identities tied to MCP servers as high-value assets. They need ownership, rotation, scope limits, monitoring, and revocation plans.

Unclear User-Agent Attribution

Teams need to know which user, agent, service account, or workflow triggered each MCP request and tool action. Without user-agent attribution, investigations become harder.

If a record changes, a file is accessed, or sensitive data leaves a system, security professionals need to trace the event back to the responsible identity and AI workflow. Missing attribution creates audit gaps and slows response.

Common MCP Server Attack Scenarios

Attackers can exploit weak MCP deployment practices in several ways. These scenarios show how technical gaps can become business risks.

Exposed MCP Servers

An exposed MCP server may be reachable from public networks, unauthorized applications, or untrusted clients. Attackers can scan for accessible services, test weak authentication, and attempt to connect directly to available tools.

If the server exposes sensitive data or high-impact actions, unauthorized access can quickly become a serious incident.

Misconfigured Permissions

Misconfigured permissions may let agents retrieve data or trigger actions outside the approved use case. A limited productivity assistant, for example, may gain access to sensitive HR records, customer files, or administrative workflows because the server was configured too broadly.

These mistakes are common when teams move fast with AI pilots and do not apply the same access review standards used for other enterprise systems.

Unmanaged API Keys

Hardcoded, long-lived, or poorly stored API keys can be stolen and reused to access connected tools or services. This risk grows when MCP servers are built quickly in local environments, copied across projects, or deployed without formal secrets management.

Attackers often look for credentials in source code, logs, configuration files, and developer machines. Once stolen, API keys may allow continued access even after the original MCP interaction ends.

Unsafe Session Handling

Weak session controls can allow replay, hijacking, or continued access after a user, agent, or token should no longer be trusted. This matters in agentic AI workflows because sessions may involve multiple steps, tools, and data sources.

Security controls should define when sessions expire, how tokens are bound to identity and context, and how access is revoked when risk changes.

Missing Logs

Absent or incomplete logging makes it difficult to trace which agent called a tool, what data was accessed, and which user or identity was involved. This creates problems for security testing, incident response, compliance, and post-event review.

MCP interaction logs should capture enough detail to support investigation without exposing sensitive information unnecessarily.

Unapproved MCP Servers

Unapproved MCP servers can bypass inventory, ownership, access review, monitoring, and incident response processes. This is the shadow MCP problem.

A developer may connect a local server for testing. A team may adopt a vendor-provided MCP tool. A business unit may experiment with multiple MCP servers before security teams know they exist. Each unmanaged connection creates a possible blind spot.

MCP Server Security Best Practices

Securing MCP requires a practical program built around visibility, access control, validation, monitoring, and response. The following MCP security best practices can help organizations reduce risk.

Inventory Every MCP Server

Track internal, remote, approved, unapproved, developer-created, and vendor-provided MCP servers. Inventory should include the server owner, purpose, connected tools, exposed data, authentication method, deployment environment, and business use case.

Assign Clear Owners

Every MCP server should have a team or individual responsible for its purpose, tools, permissions, monitoring, and retirement. Ownership helps prevent forgotten servers, unmanaged credentials, and unclear escalation paths during incidents.

Enforce Least Privilege

Limit each MCP server and agent connection to the minimum tools, scopes, and data needed. Avoid broad administrative access unless the use case truly requires it and additional approvals are in place.

Least privilege should apply to users, agents, MCP clients, service accounts, OAuth scopes, API keys, and connected systems.

Use Secure Token Handling

Avoid long-lived credentials, token passthrough, hardcoded secrets, and unmanaged service accounts. Use short-lived tokens where possible, store secrets in approved systems, rotate credentials regularly, and revoke access when a workflow, server, or user no longer needs it.

Validate Tools and Inputs

Review tool definitions, tool descriptions, parameters, prompts, files, and external content before execution. This helps reduce the risk of tool poisoning, malicious instruction injection, and unsafe tool selection.

Security teams may also use an MCP inspector or similar testing approach to examine available tools, review schemas, and validate server behavior before production use.

Monitor Tool Calls Continuously

Log which agent called which tool, what data was accessed, what action was taken, and which user or identity was involved. Monitoring should also look for unusual activity, unexpected tool combinations, repeated failures, large data retrievals, and actions outside normal workflow patterns.

Good logging supports threat intelligence, detection engineering, investigation, and compliance review.

Protect Against Prompt Injection

Prompt injection occurs when malicious instructions influence an AI system’s behavior. With MCP, the impact can be greater because the agent may have access to tools and data.

Organizations should inspect untrusted content and require approval for high-impact actions triggered by agent reasoning. These actions may include sending messages, changing records, transferring files, modifying permissions, or retrieving sensitive data.

Protect Against Indirect Prompt Injection

Indirect prompt injection can hide malicious instructions inside files, emails, documents, tickets, web pages, API responses, and knowledge base content. An AI agent may read the content as part of a normal workflow and then follow the hidden instruction.

This is especially relevant for MCP because agents often use external tools to retrieve information. Security controls should treat external content as untrusted, even when it comes from a connected business system.

Build Incident Response Playbooks

Organizations should define how teams will contain compromised MCP servers, revoke tokens, disable tools, review logs, and restore safe operation.

An MCP security checklist should include response steps for credential exposure, malicious server discovery, tool poisoning, unauthorized access, and suspicious agent activity. Security teams should also know how to isolate affected MCP connections without disrupting unrelated business systems.

How Can Mimecast Support MCP Server Security?

Mimecast Agentic AI Security can support organizations working to discover, govern, and secure agentic AI activity across enterprise environments. This is important because MCP risk does not exist only inside the MCP server. It often starts with the content, users, messages, links, files, and workflows agents process.

Mimecast’s broader Human Risk Management approach is relevant here. By helping organizations protect users, communication channels, and collaboration workflows, Mimecast can support efforts to reduce prompt injection risk, data leakage, and unsafe agent actions.

For security teams, the goal is not only to block one malicious MCP server or review one MCP tool. The bigger need is to understand where agentic AI activity is happening, how it connects to human behavior, and where sensitive workflows may need stronger AI governance.

Building Safer MCP Server Security for Agentic AI

MCP can make AI agents more useful by connecting them to enterprise tools, data sources, and applications. It can help agents retrieve the right context, call approved services, and support more practical business workflows.

As agentic AI adoption grows, securing MCP will become part of a larger AI security program. Organizations need to know how agents connect to systems, how users and machines are authenticated, how sensitive data is handled, and how malicious instructions are detected before they trigger harm.

Mimecast Agentic AI Security can help organizations strengthen visibility, governance, and protection across the agentic AI environment. For teams building with MCP, that broader view can help reduce risk while supporting safer AI adoption across the enterprise.