What is it?
An MCP server is a plug-in that can touch your files, accounts and APIs. A bad or hijacked one — or good one that returns booby-trapped text — can trick an assistant into leaking data or doing something harmful. The defence is the same as for any software supply chain, plus care about what the model is allowed to do on its own.
Also known as: MCP risks, tool poisoning, MCP prompt injection, secure MCP servers, MCP authorization, MCP best practices security, malicious MCP server, MCP supply chain.
Technical definition
Risk classes widely discussed for MCP and similar tool ecosystems: untrusted or malicious servers (supply-chain); tool-description injection ("tool poisoning") where metadata contains hidden instructions; indirect prompt injection via tool results (What is Prompt Injection?); excessive permissions and token scope; confused-deputy problems when a server uses its own credentials on a user's behalf; credential exposure in configs; rug-pull updates that change behaviour after approval; and cross-server data leakage when several servers share one context. The MCP specification and its security guidance, plus OWASP LLM guidance, describe mitigations; details evolve.
Entity type: technique · Freshness class: volatile.
When should I use it?
Apply to every MCP deployment, especially with third-party servers.
Implementation patterns
- Vendor review and pinning of server versions/hashes.
- Per-server least-privilege credentials, short-lived tokens.
- Human confirmation for writes, deletes, payments and external sends.
- Run local servers in a sandbox with restricted file/network access.
- Log tool calls and review anomalies.
Technologies and frameworks
Commonly associated: MCP specification security guidance, OAuth 2.x, sandboxing (containers, microVMs), secret managers, allow-lists. Names are examples of what exists, not recommendations, and projects change quickly.
Practical guide
- Inventory connected servers and their permissions.
- Remove unused ones.
- Scope credentials narrowly.
- Sandbox local servers.
- Require approvals for sensitive tools.
- Monitor and rotate secrets.
Common failure modes
- Auto-approving all tool calls.
- One server with a broad personal access token.
- Secrets in shared config files.
- Trusting tool descriptions as safe.
- Ignoring updates that change tool behaviour.
Troubleshooting
- Unexpected outbound requests — Block egress by default; allow-list destinations; inspect server code.
- Model follows odd instructions after a tool call — Treat the result as untrusted; strip/flag instructions; require confirmation for actions.
Contrasted with
- What is Prompt Injection? — Prompt injection is the general attack class; MCP security is its application to a tool ecosystem and supply chain.
Questions this page answers
- Is MCP secure?
- What is tool poisoning in MCP?
- How do I secure an MCP server?
- Is it safe to install a community MCP server?
- How should MCP authentication work?
Typical goals: assess whether an MCP server is safe; harden an MCP deployment.
Sources and verification
Status: not independently verified. This entry was authored on 2026-10-06 from general technical knowledge, without live checking of the sources below. Treat every source as a lead to confirm (identifier, title, authorship, current version) before publication or citation.
Freshness class: volatile — Products, versions, protocols, benchmarks, leaderboards, regulations and dates. Verify against the primary source before relying on specifics; re-review every 3 months.
Time-sensitive claims to verify before relying on them:
- Current MCP authorization requirements and security best-practice guidance.
- Named attack techniques and their prevalence.
Canonical sources (unverified leads):
- MCP specification, security and authorization guidance — modelcontextprotocol.io (locate current security pages)
- OWASP Top 10 for LLM Applications — genai.owasp.org