ShrikeWhat Is MCP Security?
MCP security is the practice of protecting AI agents and their host applications from threats that arrive through the Model Context Protocol: malicious or tampered tool definitions, poisoned tool output, impostor tools, and unvetted servers. It combines vetting what an agent connects to with governing what the connection is then allowed to do.
The Model Context Protocol gives agents a standard way to discover and call tools. That standardization is also what makes it an attack surface: any server an agent connects to can describe tools, and the agent treats those descriptions as trusted context. MCP security is about not extending that trust automatically: to the server, to the tool definition, or to what the tool returns.
What are the main MCP attack techniques?
Four recur across published research and real incident reports, and they target different stages of the tool lifecycle:
| Technique | Where it strikes | What the attacker gains | Primary defense |
|---|---|---|---|
| Tool poisoning | The tool description or schema, at load time | Hidden instructions the agent obeys as trusted metadata | Screen every schema before the agent sees it |
| Tool rug pull | A tool update, after approval | A reviewed-and-trusted slot for malicious behavior | Re-screen at every connect; pin approved schemas |
| Tool shadowing | Tool naming, at call routing | Interception of calls meant for a trusted tool | Namespaced tool identity tied to a verified server |
| Unvetted server connection | The connection itself | An entire unreviewed toolset inside the agent's reach | Declared server scope; undeclared connects are governed events |
A fifth channel cuts across all of them: poisoned tool output. Even a legitimate tool can return content that carries injected instructions: a support ticket, a web page, a database row. The agent reads that output with the same trust it gives the user's own words, which is why tool results need the same screening as prompts. (This is indirect prompt injection arriving through MCP, and it is the single most common technique in published agentic attack corpora; see the coverage map.)
Why is MCP hard to secure with existing controls?
Because the trust boundary is in an unusual place. Network controls see an HTTPS connection to a server; they don't parse tool schemas. Prompt scanners see the conversation; tool metadata and tool output flow beside it. Code review sees the server's code at one point in time; a rug pull happens after. Each control is doing its job; the attack simply arrives on a surface none of them evaluates.
The second difficulty is that a "safe" tool is not a fixed property. A tool that writes files is fine in a scratch directory and an incident in a config directory; a database tool is fine reading and consequential deleting. Vetting the tool is necessary but not sufficient; the individual calls need governing too, which is where MCP security meets action governance.
How do you secure MCP in practice?
- Screen tool definitions at every connect, not once at onboarding. A schema screen catches poisoning; repeating it on each connect catches rug pulls.
- Bind tool names to verified servers. Namespaced identity means a shadowed name has nowhere to route.
- Declare which servers an agent may use. A scope declaration turns "the agent connected to something new" from a silent event into a governed one.
- Treat tool output as untrusted input. Screen it for injected instructions and exfiltration payloads before the agent reasons over it.
- Govern the calls, not just the catalog. Every tool invocation (command, query, file write, message) evaluated against policy before it executes, with graduated verdicts (allow, warn, require approval, block).
- Keep evidence. A per-call record of what was attempted and decided is what turns an MCP deployment from unauditable to reviewable.
Related concepts
- The AI agent security stack: where tool security sits among the other control layers.
- What is action governance? The layer that governs what a vetted tool may actually do.
- The 17 agentic attack techniques: where MCP threats sit in the published taxonomy, with coverage tiers.
- Securing NemoClaw agents: sandbox boundaries and action governance, layered.
- OWASP Agentic Top 10 mapping: the risk catalog these techniques map to.
Shrike ships 14 MCP security tools that implement the controls above: schema screening at connect, scope declaration, and inline governance of every tool call, command, and query before it runs. See the MCP integration guide or start with npx shrike-mcp.