MCP Security: What Changes When a Model Decides

Model Context Protocol security differs from conventional API security because language models, rather than fixed code conditions, decide when to invoke connected tools, making tool descriptions, returned content, and other context potential sources of instruction. Key risks include indirect prompt injection through untrusted tool results, hidden malicious directives in tool descriptions, excessive permissions, OAuth token misuse, supply-chain “rug pulls” that alter tools after installation, and local server execution with client-level privileges. Recommended defenses emphasize structural controls over prompt wording: isolate sessions that access untrusted content from those with sensitive write capabilities, apply least-privilege and read-only default permissions, use separate audience-bound credentials for each server, pin and hash tool definitions, sandbox local servers, display complete commands and tool arguments for user approval, and require human confirmation for consequential actions. Effective auditing depends on server-side logs tied to caller identities, correlation across tool calls, continuous monitoring for definition changes, and adversarial testing, since an agent’s own account of its actions cannot be treated as reliable evidence.

No tracked trend matches for this post yet.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.