What Are the Security Risks of MCP Servers?
MCP (Model Context Protocol), developed by Anthropic, is rapidly becoming the standard way to extend AI coding tools and agents with external capabilities — file access, database queries, API calls, web browsing. As MCP adoption explodes, the security implications of MCP servers are becoming one of the most important new attack surfaces in AI development.
What Is an MCP Server?
An MCP server is a service that exposes tools, resources, or prompts to an AI model via the Model Context Protocol. When you connect Claude, Cursor, or another MCP-compatible AI to an MCP server, the AI can call the server's tools as part of answering your requests — reading files, querying databases, making API calls, browsing the web. MCP servers dramatically expand what AI coding tools can do, and they dramatically expand the attack surface.
Prompt Injection via Tool Results
The most critical MCP security risk is prompt injection through tool results. When an MCP tool returns data from an external source (a web page, a database record, a file), that data is injected into the AI's context. If the external data contains carefully crafted text that looks like instructions to the AI, it can redirect the AI's behavior — exfiltrating files, modifying code, or taking actions the user never intended. This is indirect prompt injection, and it is a fundamental risk in any agentic AI system that fetches external data.
Over-Permissive Tool Definitions
Many MCP servers define tools with far broader permissions than they need. A 'read file' tool that can read any file on the system — including SSH keys, credential files, and private keys — is a common example. The principle of least privilege applies to MCP tools: each tool should have the minimum access it needs to do its job, and access should be scoped explicitly.
Credential Exposure in MCP Server Configuration
MCP servers that integrate with external APIs (Slack, GitHub, databases, cloud providers) require credentials to authenticate those integrations. These credentials are frequently stored in MCP configuration files, environment files, or hardcoded in the MCP server code. Configuration files with credentials on developer machines or in shared repositories are a significant exposure risk.
Supply Chain Risk in Community MCP Servers
The MCP ecosystem has grown rapidly with hundreds of community-built MCP servers. Installing a community MCP server without auditing its code introduces supply chain risk — the server has access to everything the AI can access, including your file system, credentials, and API connections. Treat every MCP server you install like a dependency: review it, check its permissions, and understand what it can do.
How to Audit Your MCP Setup
An MCP security audit reviews: all installed MCP servers and their tool definitions, credential storage and access patterns, network access scope of each server, prompt injection resistance in tools that fetch external data, and logging and monitoring of MCP tool calls. For organizations building their own MCP servers, we review the server code itself. Contact us to scope an MCP security review for your AI development environment or product.