Model Context Protocol (MCP) has become the standard interface connecting AI agents to external tools, databases, and APIs. Anthropic released MCP in November 2024, and enterprise adoption has accelerated rapidly. Security practices have struggled to keep pace. Organizations deploying AI agents through MCP face attack surfaces that traditional security tools cannot detect, including tool poisoning, prompt injection, supply chain compromise, and credential theft.

According to IBM's 2024 Cost of a Data Breach Report, the average data breach now costs organizations $4.88 million. AI-connected systems introduce additional risk vectors that can amplify breach impact significantly.

What Is MCP and Why Does Security Matter?

MCP is an open protocol that standardizes how Large Language Models (LLMs) interact with external systems. The architecture consists of three core components working together.

MCP hosts are applications like Claude Desktop, coding IDEs, or enterprise AI tools that create and manage client connections. MCP clients connect to servers with one-to-one relationships, handling communication between the host and external tools. MCP servers expose data sources, tools, and prompts through standardized interfaces.

MCP does not directly connect LLMs with tools. The client component accesses the LLM while the server component accesses tools. Multiple trust boundaries exist between these components, and each boundary introduces potential vulnerabilities. Understanding how agentic AI transforms AppSec helps security teams recognize these emerging attack patterns.

Critical MCP Vulnerabilities in LLM Integrations

Security researchers have identified ten distinct vulnerability classes affecting MCP implementations.

Tool Poisoning and Behavioral Subversion

Attackers embed malicious instructions within MCP tool descriptions that users cannot see, but AI models process as commands. The attack sequence follows a predictable pattern: an attacker creates or compromises an MCP server, hides malicious instructions in tool metadata, and waits for the AI model to read and execute hidden commands while users see only legitimate tool descriptions.

A weather checking tool might include hidden instructions to exfiltrate environment variables or API keys whenever invoked. Users see weather results while credentials are silently stolen.

Prompt Injection Through External Data

Indirect prompt injection has become significantly more dangerous with MCP. Attackers craft messages containing hidden instructions that appear harmless to users but command AI agents to perform unauthorized actions.

Malicious content in emails, database entries, or documents can contain invisible Unicode characters instructing AI agents to forward sensitive data to external addresses. Security scanners miss these attacks because visible text appears normal.

Supply Chain Compromise

MCP servers consist of executable code vulnerable to supply chain attacks. Techniques include masquerading (malicious packages named to resemble legitimate ones), typosquatting (exploiting spelling errors), trojan packages (malware embedded in functional tools), and dependency confusion (exploiting naming overlaps between public and private repositories).

Compromised components can execute code with elevated privileges, introduce persistent backdoors, or extract sensitive data silently.

Rug Pull Attacks

A rug pull occurs when an MCP server initially behaves correctly but later changes functionality to perform malicious actions. Tool definitions can update dynamically without user notification. A legitimate tool might operate normally for weeks before suddenly beginning credential theft or data exfiltration.

Building a defensible architecture for APIs provides foundational protection against these delayed attacks.

Name Spoofing and Tool Confusion

Attackers register tools with names closely resembling legitimate ones. AI agents relying on semantic similarity rather than exact matching may invoke counterfeit tools in sensitive workflows. Attackers can intercept confidential data or introduce compromised logic while imitating trusted tools.

Single Point of Privilege Exploitation

MCP environments often rely on central orchestrators authorized across multiple environments. If one tool within the structure becomes compromised, attackers may use the orchestrator to invoke or control other tools, inheriting broad access. A localized breach can escalate to full workflow compromise quickly.

Credential and Token Theft

MCP servers storing authentication tokens for multiple services represent high-value targets. Successful breaches grant attackers access to all connected service tokens (email, cloud storage, code repositories), the ability to execute actions across integrated services, and corporate resources if work accounts are connected.

Review API authentication methods to implement stronger access controls for MCP deployments.

Context Bleeding Across Sessions

GenAI applications relying on persistent memory can experience context bleeding where one user's sensitive data becomes accessible to another. Without proper isolation in shared vector stores or memory buffers, privacy breaches occur alongside unpredictable model behavior.

Shadow Capabilities

Some MCP tools include undocumented behaviors that go beyond declared functionality. Hidden features may initiate network communications, perform privileged actions, or respond to specific prompts in unexpected ways. Because shadow capabilities are not explicitly documented or tested, they create significant blind spots.

Denial of Wallet Attacks

Attackers repeatedly trigger expensive operations (commercial API calls, compute-intensive queries) until platforms exhaust resource budgets. Services become inaccessible through financial exhaustion rather than traditional denial of service.

How to Defend Against MCP Risks

Effective protection requires layered security across multiple domains. Following security by design principles establishes the foundation for secure MCP implementations.

Validate and Sanitize All Inputs

Filter user queries, tool metadata, and server responses for dangerous patterns before reaching LLM agents. Pattern matching alone is insufficient because attackers constantly develop new encoding techniques. Implement strict input schemas limiting prompt length, character sets, and structural patterns.

Implement Least Privilege Access

MCP tools should operate with the minimum necessary permissions only. Enforce granular access controls, ensuring each tool accesses only specific data, API endpoints, or system resources it legitimately requires. The ultimate API security checklist provides additional controls for permission management.

Require Human Approval for Sensitive Operations

Human-in-the-loop (HITL) controls require user confirmation before executing file system modifications, external communications, database writes, and credential usage. Balance security with usability through intelligent approval workflows.

Monitor for Tool Changes

Rug pull attacks succeed because users never see updated tool descriptions. Pin MCP server versions and implement automated monitoring to detect suspicious modifications to tool metadata or behavior patterns.

Secure the Supply Chain

Verify the integrity of all MCP dependencies before integration. Implement Static Application Security Testing (SAST) and Software Composition Analysis (SCA) in build pipelines. Scan for known vulnerabilities and malware in all components.

Guidance on securing AI APIs provides additional supply chain security context.

Strengthen Your MCP Security Skills

MCP security represents a critical skill gap across the industry. The MCP Security Fundamentals course provides hands-on training covering tool poisoning, prompt injection, supply chain attacks, and defense strategies. Earn 2 CPE credits while learning to protect organizations adopting MCP.

Enroll in APIsec University to access free courses taught by industry experts.

For continuous API security testing that identifies vulnerabilities attackers exploit through MCP connections, visit APIsec and start your free scan.

FAQs

What makes MCP different from traditional API security risks?

MCP introduces AI-specific vulnerabilities like tool poisoning and prompt injection that exploit trust relationships between models and tool descriptions. Traditional scanners miss attacks embedded in natural language.

How do tool poisoning attacks work in MCP?

Attackers hide malicious instructions in tool metadata that users cannot see. AI models read instructions as legitimate commands and execute unauthorized actions while displaying normal results.

Can existing security tools protect MCP implementations?

Traditional security tools address only a subset of MCP threats. Organizations need specialized monitoring covering prompt injection detection, tool verification, and behavioral analysis.

What is a rug pull attack in MCP security?

A rug pull occurs when a trusted MCP server updates functionality to perform malicious actions after gaining trust. Tool definitions can change dynamically without user notification.

How does context bleeding affect MCP security?

Context bleeding occurs when persistent AI memory leaks data across user sessions. Without proper isolation, one user's sensitive information may become accessible to others.

What should organizations prioritize first for MCP security?

Audit all MCP server connections and implement strict input validation. Establish formal approval processes for new servers, pin versions to prevent unauthorized updates, and monitor for behavioral changes.