Top MCP Security Risks Enterprises Need to Address

At the center of the rapid evolution of agentic AI is the Model Context Protocol (MCP). MCP is an emerging open standard that enables AI models to securely connect to enterprise tools, APIs, databases, and external services. Rather than building custom integrations for each AI application, enterprises can expose their capabilities through MCP servers. This allows AI assistants and autonomous agents to discover and use tools dynamically. While this dramatically improves interoperability, it also introduces a significant new attack surface: a compromised MCP server can give attackers indirect access to enterprise systems. This article explores the top MCP security risks enterprises need to address for secure AI adoption and use.

Key Takeaways

• MCP creates a standardized integration layer between AI models and enterprise systems.
• MCP servers are increasingly becoming high-value targets because they broker and facilitate access to business tools and data.
• Prompt injection, tool poisoning, identity abuse, and excessive permissions are among the most significant security risks associated with MCPs.
• Traditional endpoint and API security solutions provide only partial visibility into MCP activity.
• Enterprises should apply modern security practices such as Zero Trust, least privilege, continuous monitoring, and AI governance to MCP environments.

Understanding MCP and Why Security Matters

MCP enables AI models to discover and invoke enterprise tools using a standardized interface. This allows AI developers and enterprise applications to integrate AI capabilities without having to build custom connectors for every system. Instead of relying on hard-coded integrations, an AI agent can dynamically connect to a variety of enterprise systems including:

• CRM systems
• Source code repositories
• Knowledge bases
• Databases
• Ticketing systems
• Cloud services
• Internal APIs
• Collaboration platforms

This flexibility brought about by MCP accelerates AI deployment while reducing integration complexity, allowing organizations to scale their AI capabilities more efficiently. However, MCP also concentrates access to enterprise resources within a single protocol layer, which creates a high-value target for attackers. For instance, a compromised MCP server can expose multiple systems simultaneously, making a robust security architecture essential from the outset.

Local vs. Remote MCP Servers

Not all MCP deployments present the same authorization risks, and therefore each requires its own different set of security considerations. Organizations should therefore distinguish between local (STDIO) MCP servers that run on developer endpoints and remote HTTP-based MCP servers.

• Local (STDIO) MCP servers run directly on the developer’s workstation and typically inherit the user’s ambient credentials and operating system privileges, often without separate authentication. They can access resources available to the logged-in user, including active SSO sessions, cached cloud credentials, local configuration files, and development secrets. In local MCP environments, the primary security risk is executing untrusted code or tools with the full privileges of the developer’s endpoint.
• Remote HTTP-based MCP servers do not rely on ambient user credentials but instead authenticate using protocols such as OAuth 2.1 and exchange scoped access tokens. While this approach provides stronger identity separation, security risks remain, including token passthrough, overly broad token scopes, and confused deputy scenarios.

Because these deployment models present different attack surfaces, organizations should apply distinct authorization controls. For example, local MCP servers typically require strong endpoint security, hardened developer workstations, and controls on locally executed tools, whereas remote MCP servers can benefit from scoped tokens, audience binding, continuous authorization, and robust API access governance.

Top MCP Security Risks Enterprises Need to Address

The following are the top risks associated with MCP that enterprises must address to strengthen their AI security posture:

• Rug pull: A server presents benign tool definitions at approval time, then changes them later. Approval is a point-in-time event, while tool definitions are mutable. This is the strongest argument for hashing tool definitions and alerting on drift.
• Cross-server tool shadowing: A malicious server emits a tool description that manipulates how the agent uses a different, trusted server’s tools. This is genuinely novel to MCP and the most interesting thing in the whole space.
• Token passthrough: This refers to an anti-pattern in which an MCP server accepts tokens from an MCP client without validating that the tokens were properly issued to the MCP server. It then passes them through to the downstream API, introducing several risks such as security control circumvention as well as accountability and trust boundary issues.¹
• Proxy confused deputy problem: Threat actors can exploit MCP proxy servers that connect to third-party APIs, creating confused deputy vulnerabilities. This attack allows malicious clients to obtain authorization codes without proper user consent by exploiting the combination of static client IDs, dynamic client registration, and consent cookies.
• Indirect Prompt Injection: Prompt injection remains one of the most significant threats to AI systems, including MCP-enabled environments. Unlike traditional application attacks that exploit software vulnerabilities, prompt injection manipulates the instructions that an AI model processes. Common sources of prompt injection attacks include:
  • Hidden instructions within documents
  • Malicious web pages
  • Poisoned emails
  • Compromised knowledge bases
  • Manipulated API responses

  When an AI agent trusts malicious content, it may reveal sensitive information, ignore security policies, and execute unintended actions. This can result in the AI agent gaining unauthorized access to enterprise resources. In MCP environments, prompt injection can affect not only the model outputs provided but also the tools and services an AI agent selects for invocation. Therefore, strong defenses against prompt injection are essential for enterprises operating in MCP-enabled AI environments.

• Tool Poisoning: This is perhaps the most distinctive threat introduced by MCP. MCP tool poisoning arises because AI agents dynamically discover and trust tools as part of their operations. Attackers may compromise or manipulate those tools to influence AI behavior in ways never intended by the user. Examples include:
  • Modified tool descriptions
  • Malicious API responses
  • Altered metadata
  • Unauthorized plugins
  • Compromised MCP servers

  Rather than attacking the AI model directly, attackers can corrupt the ecosystem surrounding it, including MCP servers, tools, and associated metadata. The result is an AI agent that unknowingly makes decisions based on malicious resources that are not intended by the user.

  For additional insights into supply chain risks, refer to this article: Understanding AI Supply Chain Risk: https://pluto.security/blog/ai-supply-chain-risk/

• Excessive Permissions: Many AI agents receive broad permissions either to enhance operational efficiency and effectiveness or to prevent workflow failures. Typical examples of excessive permissions include:
  • Full repository access
  • Organization-wide document search
  • Administrative cloud privileges
  • Broad SaaS permissions
  • Database administrator roles

  From a security perspective, these permissions often violate the principle of least privilege. As a result, if an MCP server is compromised, the excessive permissions can dramatically increase the scope and impact of an attack.

• Identity Impersonation: MCP environments rely heavily on machine identities for authentication. Weak authentication or poor credential management can allow attackers to impersonate AI agents, register rogue MCP servers, and hijack trusted sessions. This increases the risk that AI agents will execute unauthorized workflows across the entire enterprise environment.
• Data Exfiltration: AI agents frequently retrieve enterprise data through MCP connections. Without effective monitoring and policy enforcement, attackers may exploit these connections to exfiltrate sensitive data. They can also access regulated information, increasing compliance risk. This risk is amplified because traditional Data Loss Prevention (DLP) solutions often lack visibility into AI-driven workflows, making them less effective.
• Shadow MCP Infrastructure: As many enterprises rapidly accelerate AI adoption, development teams may deploy unofficial MCP servers without adequate security review. This creates shadow MCP infrastructure, resulting in unknown integrations, weak authentication, and unpatched software. This increases exposure by expanding the attack surface.

How Attackers Chain MCP Vulnerabilities to Move Laterally Across Enterprise Systems

MCP attacks rarely rely on a single vulnerability. Instead, threat actors often combine multiple weaknesses to achieve broader objectives. A typical attack chain involving MCP may unfold as follows:

• Step 1: Initial Compromise: An attacker introduces malicious instructions through prompt injection or compromises an external tool.
• Step 2: Tool Discovery: The AI agent discovers available MCP tools and APIs.
• Step 3: Unauthorized Tool Invocation: Manipulated instructions cause the AI agent to invoke sensitive enterprise services.
• Step 4: Credential Abuse: The adversary exploits excessive permissions associated with the AI agent.
• Step 5: Lateral Movement: Additional enterprise AI systems become accessible through trusted MCP connections.
• Step 6: Data Exfiltration or Business Impact: Sensitive information is extracted, or critical AI workflows are manipulated.

Unlike traditional lateral movement, these actions often appear legitimate because they are executed through trusted AI workflows rather than malware. Existing security controls may remain important, but they often provide only partial visibility into AI-driven attack chains.

Notable MCP Security Incidents

For additional insights into securing MCP environments and AI ecosystems, refer to these articles:

MCP Bug in Nginx: Critical CVSS 9.8 Security Vulnerability

One Request to Own Every Repo: How We Hijacked GitLab Through Its MCP Server

MCPwnfluence: Critical Unauthenticated SSRF to RCE Attack Chain in the Most Widely Used Atlassian MCP Server

Recent security research demonstrates that MCP security risks are no longer theoretical but have already emerged in AI production environments, as shown from the following examples;

• GitHub MCP Prompt Injection (Invariant Labs, 2025)²: In this study, researchers demonstrated that an attacker could embed a hidden prompt injection payload in a public GitHub issue. When an AI coding agent processed the issue using GitHub MCP, it followed the malicious instructions and used its authenticated GitHub token to access private repositories. It also disclosed sensitive information in a public pull request. Researchers concluded that such attacks cannot be fully mitigated through server-side patches alone but would require architectural controls including stronger authorization boundaries, scoped permissions, and continuous policy enforcement.
• CVE-2025-49596 – MCP Inspector Remote Code Execution³: A critical vulnerability (CVSS 9.4) affecting MCP Inspector demonstrated that developer workstations can also be a direct attack surface. This vulnerability allowed unauthenticated remote code execution because the proxy accepted some arbitrary STDIO commands from a browser client. This highlighted the risks associated with locally executing MCP servers that inherit developer privileges. It reinforces the need for endpoint hardening, least privilege, and secure execution boundaries in MCP-enabled environments.

These incidents demonstrate to security teams that securing MCP environments requires more than authentication; it also requires the implementation of robust authorization controls. It is crucial for security teams to continuously validate AI agent behavior and apply security measures appropriate to both local and remote MCP deployments.

What Enterprise Security Teams Need to Put in Place Before MCP Becomes a Standard Integration Layer

Organizations should establish security controls before MCP adoption scales to reduce the risks of compromise. This should include the implementation of the following controls:

• Inventory Every MCP Server: Maintain a complete inventory of MCP servers, third-party MCP integrations, connected AI agents, and all associated identities. This is key as visibility forms the foundation of governance in enterprise AI environments.
• Enforce Least Privilege: Grant AI agents only the permissions required for specific tasks and nothing more. Implementing temporary, Just-in-Time (JIT) access and conditional access processes will significantly reduce attack exposure.
• Validate Tool Integrity: Organizations should continuously and holistically verify tool integrity, including tool authenticity, metadata integrity, approved publishers, and configuration changes. This continuous validation helps prevent incidents of MCP tool poisoning.
• Pin MCP Server Versions: Always pin MCP server versions before deployment. Monitor for unexpected changes to server binaries, manifests, or tool definitions, as unauthorized modifications may indicate a compromised MCP server or a supply-chain attack.
• Separate Sensitive Data: Never allow an AI agent to access sensitive internal data or external communication tools, especially in the same execution context. This lethal trifecta of private data, untrusted content, and outbound communication creates a high-risk path for prompt injection attacks. Separation significantly reduces the potential impact of compromised agents.
• Containerize Local MCP Servers: Run local MCP servers in secure containers or isolated execution environments rather than directly on developer workstations. This prevents MCP servers from automatically inheriting ambient credentials, SSH keys, cloud credentials (such as ~/.aws/credentials), and other sensitive resources typically available to the logged-in user.
• Require Human Confirmation: Configure MCP-enabled AI agents to require explicit human confirmation before performing high-risk actions. These actions include executing state-changing operations such as deleting data, modifying production systems, approving transactions, or exposing sensitive information.
• Restrict Network Egress: Apply outbound network allowlists to MCP server hosts. This ensures that AI agents can communicate only with approved services and APIs. Limiting outbound connectivity also reduces opportunities for data exfiltration and prevents compromised agents from communicating with attacker-controlled infrastructure.
• Use Audience-Bound, Short-Lived Tokens: Issue scoped, audience-bound, short-lived OAuth tokens with resource indicators instead of passing user access tokens directly to upstream APIs. This limits token misuse, prevents token passthrough attacks, and enforces least privilege across all MCP integrations.
• Monitor AI Activity: Continuously log and analyze AI activity across the entire organization. Monitor tool invocations, prompt history, and authorization decisions. Monitoring should also extend to API calls, data access, and policy violations. This comprehensive telemetry improves incident response and compliance.

Frequently Asked Questions

1. Why are MCP servers a high-value attack target?

MCP servers are high-value targets because they mediate access between AI models and enterprise resources, including APIs, databases, SaaS platforms, and internal applications. Compromising an MCP server can grant attackers indirect, unauthorized access to multiple enterprise systems. This makes MCP servers attractive targets for cyber espionage, data theft, and lateral movement by threat actors.

2. How does MCP tool poisoning differ from supply chain attacks?

Supply chain attacks compromise software or dependencies before they are deployed to enterprise environments. In contrast, MCP tool poisoning targets the AI tools, metadata, or services that AI agents dynamically discover and invoke during operation. In MCP poisoning, rather than infecting software binaries, attackers manipulate the AI’s trusted operational environment, influencing decisions without modifying the underlying model.

3. Can endpoint security tools detect malicious MCP behavior?

Partially. While traditional endpoint security solutions can detect operating system events and malicious processes in MCP environments, they generally lack sufficient visibility into AI-specific MCP activities. These include prompts, tool selection processes, authorization decisions, and protocol-level interactions. Modern enterprises should therefore supplement traditional EDR tools with AI-aware monitoring and MCP-specific controls.

4. How do you enforce least privilege across MCP connections?

Assign unique identities to AI agents. Grant task-specific permissions to prevent overprovisioning. Then implement modern security practices, such as just-in-time (JIT) access and conditional access. Also, continuously evaluate authorization decisions, regularly review connected tools and services, and ensure that least privilege applies to every MCP server, API, and enterprise integration.

5. What belongs in an MCP server security review checklist?

An effective MCP server security review should assess authentication, authorization, identity management, tool integrity, prompt injection protections, and monitoring and logging processes. It should also evaluate encryption, API security, configuration management, software updates, third-party dependencies, and monitoring and incident response processes. An enterprise-grade checklist should ideally conclude with compliance with enterprise AI governance requirements.

Looking Ahead

MCP is rapidly emerging as a foundational integration layer for enterprise AI ecosystems. As adoption accelerates, attackers will increasingly target the protocol, its associated tools, and machine identities, rather than AI models. Organizations that implement governance, visibility, and security controls early will be better positioned to adopt AI safely while maintaining resilience against emerging threats. For CISOs, securing MCP should not be viewed as merely another application security initiative but as an essential component of enterprise AI strategy.

Useful References

1. Anthropic. (2025). Model Context Protocol Specification.
   https://modelcontextprotocol.io
2. Model Context Protocol. (n.d.). Security best practices.
   https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices
3. National Vulnerability Database. (2025). CVE-2025-49596. National Institute of Standards and Technology.
   https://nvd.nist.gov/vuln/detail/CVE-2025-49596
4. OWASP Foundation. (2025). OWASP Top 10 for LLM Applications.
   https://genai.owasp.org/
5. Patel, K. (2025, June 3). GitHub MCP server private-repo exfiltration: The May 2025 Invariant Labs disclosure. Safeguard.
   https://safeguard.sh/resources/blog/github-mcp-private-repo-prompt-injection-2025
6. National Institute of Standards and Technology. (2024). Artificial Intelligence Risk Management Framework (AI RMF 1.0).
   https://www.nist.gov/itl/ai-risk-management-framework