MCP introduces security considerations that differ from traditional API architectures in three important ways. Learn more

First, the client is an AI agent, not a deterministic application. An API client sends requests that a developer explicitly coded. An MCP client sends requests that an AI model generates at runtime based on natural language prompts. This means the request surface is unpredictable. An agent might construct a tool call that accesses data the developer never intended it to, not because of malicious intent, but because the model's interpretation of the prompt led to a valid-but-unintended request.

Second, MCP servers typically have broader access than the tools they expose. An MCP server connected to Jira has access to the full Jira API, but it should only expose a scoped subset of operations to AI agents. The gap between what the server can do and what agents should be allowed to do through it is the primary attack surface. A compromise or misconfiguration that exposes the full API surface to agents is a privilege escalation path.

Third, MCP's tool discovery mechanism means agents learn what tools are available at runtime. When an agent connects to an MCP server, it queries the server's capabilities and dynamically decides how to use them. This is different from a hardcoded API integration where the available operations are determined at development time. An MCP server that adds a new tool (intentionally or through a malicious update) can change agent behavior without any code change in the agent itself.

These characteristics produce a threat model with four primary vectors.

Credential compromise gives an attacker full access to everything the MCP server can reach. Since 53% of servers use static credentials, a single compromised token provides persistent, unscoped access. The CVE-2025-6514 incident demonstrated how credential compromise at scale can propagate through developer environments.

Privilege escalation through tool chains occurs when an agent uses one MCP server to gain access to another, escalating its effective permissions beyond what any single server was intended to provide. If Server A provides read access to customer records and Server B provides write access to the billing system, an agent that chains calls to both servers has read/write access across customer and billing data, a combination that neither server was individually designed to permit.

Data exfiltration through context exploits MCP's design as a context protocol. Agents request data from MCP servers to build context for their reasoning. An attacker who compromises an agent (through prompt injection or other means) can use this context-gathering capability to extract data from any MCP server the agent connects to, effectively turning the agent into a data exfiltration tool. The attack is particularly dangerous because it uses MCP's intended functionality (context gathering) for an unintended purpose (exfiltration), making it difficult to distinguish from normal agent behavior through simple monitoring.

Supply chain attacks through server updates target the MCP server itself. When a server is updated (either by its maintainer or through a compromised update pipeline), new tools or modified capabilities are automatically available to all connected agents. An attacker who compromises the update mechanism can introduce malicious tools that agents begin using immediately. Learn more