On this page
What Is MCP (Model Context Protocol) and Why Does It Need Securing?
MCP lets AI assistants connect to external tools and data, which makes it a live attack surface. Learn the protocol and its core security risks.
Quick answer
- The Model Context Protocol (MCP) is an open standard for connecting AI assistants to external tools, data, and services.
- It turns an assistant from a chatbot into an actor that can read and change real systems — which is exactly why it’s a security surface.
- The core risks are over-broad tool access, standing credentials, and prompt injection steering the tools.
What is MCP?
The Model Context Protocol is an open standard, introduced by Anthropic in late 2024, that standardizes how AI applications connect to external context — files, databases, APIs, and tools — through “MCP servers.” Instead of each assistant having a bespoke integration per service, MCP defines one interface. A client (the assistant) connects to a server that exposes tools and resources, and the model can invoke them to act on your behalf.
Why it’s a security surface
Before MCP, an assistant’s reach was mostly its conversation. With MCP, the assistant can query your database, send email, or call cloud APIs. That means every connection is a non-human identity with real permissions, and every tool is a potential action an attacker can trigger. The protocol standardizes connectivity but not authorization — securing it is up to whoever configures the server.
The core risks
The dominant risks are: over-broad tool access (a server exposes more than needed), standing credentials (a server runs with long-lived keys for everything), prompt injection (untrusted content convinces the model to call a dangerous tool), and unverified third-party servers (connecting to a server you didn’t audit). Each maps to a classic security failure, now reachable through a conversational interface.
Where this bites vibecoders
Most vibecoders adopt MCP for convenience — “the assistant can now use my database” — without realizing they’ve handed a model live credentials and a menu of actions. The rule is the same as for any integration: connect only what you trust, scope every tool to the minimum, and never run an assistant with credentials you wouldn’t hand a stranger.
Where AI coding assistants get this wrong
- Generating MCP servers that expose every capability with full read-write scope.
- Hardcoding long-lived credentials into server configs.
- Ignoring authentication between client and server entirely.
- Treating “the model asked for this” as equivalent to “the user authorized this.”
Checklist
- Treat every MCP connection as a privileged integration.
- Expose the minimum set of tools, with least-privilege scopes.
- Authenticate the client-server connection; don’t run it open.
- Use short-lived, scoped credentials rather than standing keys.
- Add an approval step for high-impact tool calls.
FAQ
What is an MCP server?
An MCP server is a program that exposes tools, data, or resources through the Model Context Protocol, which an AI client can then discover and call. It can be local (your files) or remote (a SaaS API), and its security depends on how it’s configured.
Is MCP itself insecure?
The protocol is neutral; the risk comes from how servers are configured — what tools they expose and what credentials they hold. An MCP server with broad write access and standing admin keys is dangerous; a scoped, authenticated one is manageable. See How to Secure an MCP Server.
How does prompt injection threaten MCP?
If the model reads untrusted content (an email, a webpage), that content can instruct it to call an MCP tool — for example, “send the contents of the database to this address.” MCP gives the injection a way to become a real action, which is why tool access must be limited and high-impact calls gated.