Model Context Protocol (MCP) security is the practice of securing the connections through which AI agents access external tools, data, and services using MCP, an emerging standard for linking AI models to the systems they act on. As agents rely on MCP to do real work, those connections become a new attack surface that needs identity, authorization, and monitoring.

MCP lets an AI model call tools and reach data sources in a standardized way. That capability is what makes agents useful, and also what makes them risky if the connections are not governed.

The risks

An agent connected to tools and data through MCP can, if compromised or manipulated, misuse those connections: accessing data it should not, taking actions beyond its mandate, or being steered by a prompt-injection attack into harmful tool calls. Over-broad permissions on MCP connections are especially dangerous, because they let a hijacked agent reach far. The connections need the same scrutiny as any privileged access path.

Securing MCP

MCP security applies familiar identity principles to a new context: authenticate the agent and the tools it connects to, enforce least-privilege, scoped permissions on what each connection can do, issue short-lived rather than standing access, monitor tool calls for anomalous or malicious activity, and defend against prompt injection that tries to hijack the agent’s actions. As MCP and agent tooling mature, treating these connections as governed, least-privilege access, rather than open pipes, is what keeps agentic systems safe.

Frequently asked questions

What is MCP security?

Securing the connections AI agents use to access tools and data via the Model Context Protocol.

Why is it a concern?

These connections are a new attack surface; a compromised or over-permissioned agent can misuse them to reach data or take harmful actions.

How do you secure MCP connections?

Authenticate agents and tools, enforce scoped least-privilege permissions, use short-lived access, monitor tool calls, and defend against prompt injection.

Related: Agent Identity · Delegated Authority · Fine-Grained Authorization (FGA) · Prompt Injection · Non-Human Identity (NHI)