What Is MCP Security? A Practical Introduction

The National Security Agency's Artificial Intelligence Security Center released a Cybersecurity Information Sheet on May 20, 2026 warning that adoption of Anthropic's Model Context Protocol (MCP) has outpaced expected safeguards, because MCP reverses the usual client-server data flow and "often expects servers to query and sometimes execute actions for the connected clients." The NSA guidance followed three separate flaws in Anthropic's Git MCP server — CVE-2025-68145, CVE-2025-68143 and CVE-2025-68144 — which researchers at Cyata chained with a separate Filesystem MCP server to achieve full remote code execution; Anthropic patched all three in December 2025. MCP, an open standard Anthropic released in November 2024 and now hosted by the Linux Foundation's Agentic AI Foundation, is used by OpenAI, Google, Microsoft and Block.

Say you ask an AI assistant, “What’s the weather where I am, and should I bring an umbrella tomorrow?” To answer, the assistant needs your location, real weather data, and a way to reason over both. The model has none of that built in. Model Context Protocol MCP is the open standard Anthropic released in November 2024 https://www.anthropic.com/news/model-context-protocol to fill that gap. MCP is an open-source standard for connecting AI applications to external systems. It lets an AI system ask an external tool “what can you do?” and then call that tool for the information. Without it, every AI application would need its own custom connection to every weather service, database, or calendar it might ever use. MCP security means protecting that connection and the data passed to the AI assistant. It deals with the vulnerabilities that appear once a model can take actions as well as answer questions. What MCP does MCP’s own documentation compares it to a USB-C port for AI applications https://modelcontextprotocol.io/docs/getting-started/intro : one common plug instead of a different cable for every device. It has three basic building blocks https://modelcontextprotocol.io/specification/2025-06-18/server : - Tools are actions an agent can take, like sending an email or querying a database - Resources are data an agent can read - Prompts are reusable templates that shape how an agent behaves In the weather example, “get current weather for a location” would be a tool. A weather MCP server exposes it, and the assistant calls it mid-conversation. Adoption has been fast. OpenAI, Google, Microsoft, and Block are all platinum members of the Agentic AI Foundation https://www.linuxfoundation.org/press/linux-foundation-announces-the-formation-of-the-agentic-ai-foundation , the Linux Foundation body that now hosts MCP. The standard shows up in business, finance, legal, and software development tools, anywhere an AI system needs to reach outside its own conversation to get something done. Why MCP security is urgent now On May 20, 2026, the Artificial Intelligence Security Center of the National Security Agency NSA released a Cybersecurity Information Sheet https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4496698/ on MCP. It warns that adoption has outpaced the safeguards MCP’s designers and implementers expected. Its core point is that MCP reverses a pattern security teams know well. In the NSA’s words https://www.nsa.gov/Portals/75/documents/Cybersecurity/CSI MCP SECURITY.pdf , “instead of clients requesting data from servers, MCP often expects servers to query and sometimes execute actions for the connected clients.” That reversal opens attack paths that older web-security thinking doesn’t automatically cover. Here are some recent examples, in plain terms: - Anthropic’s own Git MCP server had three separate flaws https://thehackernews.com/2026/01/three-flaws-in-anthropic-mcp-git-server.html , each with its own Common Vulnerabilities and Exposures CVE number: the public, standardized record security researchers use to track a specific known flaw. One CVE let attackers bypass the server’s repository restriction through unvalidated paths CVE-2025-68145 https://nvd.nist.gov/vuln/detail/CVE-2025-68145 . One let its git init tool turn any accessible directory into a Git repository with no validation CVE-2025-68143 https://nvd.nist.gov/vuln/detail/CVE-2025-68143 . The third passed user-controlled input straight into Git commands without sanitizing it CVE-2025-68144 https://nvd.nist.gov/vuln/detail/CVE-2025-68144 . None of the three was catastrophic alone. Then researchers at Cyata chained the Git server with a separate Filesystem MCP server. Chained together, these flaws gave attackers full remote code execution. Anthropic patched all three in December 2025. - MCP Inspector , the tool developers use to test MCP servers while building them, had its own remote code execution flaw https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596 CVE-2025-49596 https://nvd.nist.gov/vuln/detail/CVE-2025-49596 . An attacker could run arbitrary commands on a developer’s machine just by getting them to visit a malicious website while Inspector was running. - GitHub MCP server could be turned against its own user. Invariant Labs showed https://invariantlabs.ai/blog/mcp-github-vulnerability that a malicious issue in a public repository could hijack a connected agent whose token covered all of the user’s repositories. The agent then read data from private repos and leaked it in a public pull request. Invariant traced the problem to overly broad access rather than a bug in the server’s code. - In a WhatsApp MCP attack described in another Invariant Labs demonstration https://invariantlabs.ai/blog/whatsapp-mcp-exploited , the server posed as a harmless “random fact of the day” tool when first installed, then switched to a malicious tool description on its second launch. The new description hijacked the user’s legitimate WhatsApp MCP server and exfiltrated message history, and the user was never asked to approve the change. These weren’t all obscure or sketchy implementations. Several are official reference tools that a large share of the ecosystem builds on directly. And the problem goes well beyond a few headline cases. In the two months before August 2026 https://www.anaconda.com/press/anaconda-acquires-enkrypt-ai , Enkrypt AI scanned more than 268,000 tools across 25,000 MCP servers and found over 143,000 vulnerabilities, affecting 73% of those servers. The failure patterns worth knowing by name MCP failures fall into a small set of recurring patterns: - Injection-driven tool use: attacker text tricks the agent into calling a tool with parameters the attacker chose instead of the user. - Privilege escalation: an agent reaches tools or data beyond its intended access, often by chaining several small steps that each look reasonable. - Data exfiltration: sensitive information leaves the system through a tool’s response, or through parameters encoded to smuggle it out. - Response smuggling: a malicious or compromised MCP server sends back a reply crafted to hijack what the AI system does next. - Shadow MCP adoption: someone connects a new MCP server that never goes through security review, so it runs in production and nobody knows it’s there. - Environment drift: the servers and permissions approved in testing drift away from what runs in production. Almost none of these are jailbreaks in the usual sense, where a model is tricked into saying something harmful. In these cases the model is tricked into calling something dangerous. How to build a secure MCP server This section is for the engineer writing or configuring an MCP server. If that’s not you, skip to “Securing MCP across an organization” below. The NSA’s guidance https://www.nsa.gov/Portals/75/documents/Cybersecurity/CSI MCP SECURITY.pdf recommends building these in from the start instead of patching them in later. Validate parameters against what the tool will do. Checking that a parameter has the right data type isn’t enough. A valid-looking input can manipulate a hidden parameter into triggering file access the tool was never meant to allow. Check inputs against expected ranges and against the action the tool is about to take. Treat every tool’s output as untrusted. Once content from the model and content from an external server sit in the same context, the model can’t reliably tell them apart. Filter each tool’s output and scan it for embedded instructions before passing it on. Give it the same care you’d give input typed by a stranger. Review every capability change. The WhatsApp attack worked because the server’s description changed after the user had approved it. If an approved server’s tools, permissions, or descriptions change, that should trigger a fresh review. Sandbox execution and default to deny. Limit what a tool can touch at the operating-system level with isolation frameworks like seccomp https://www.kernel.org/doc/html/latest/userspace-api/seccomp filter.html , AppArmor https://apparmor.net , or SELinux https://github.com/SELinuxProject/selinux , instead of relying on application code alone. If a server doesn’t need the file system or the internal network, deny that access explicitly. Add the session hygiene MCP doesn’t require. Authorization in MCP is optional https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization , and the NSA notes the protocol doesn’t require tokens to expire, rotate, or resist reuse. You have to build in expiry and reuse detection yourself, because the protocol doesn’t require it. Log every tool call. MCP’s own logging guidance is basic, and the NSA found many implementations log nothing or only minimal metadata. Record every tool call, its parameters, and who or what triggered it, and send that to whatever monitoring system your security team already uses. Without those logs, you’ll have almost nothing to investigate after something goes wrong. Build on maintained projects. Some widely used MCP servers are no longer actively maintained, and several early reference servers now sit in an archived repository https://github.com/modelcontextprotocol/servers-archived with no security updates. They can still touch a file system or a database. Check a project’s maintenance status before you build on it. Securing MCP across an organization Well-built servers matter, but they aren’t enough on their own. At the organization level, securing MCP comes down to four steps: 1. Scan every MCP server for known vulnerabilities before adopting it. 2. Curate an approved registry, so there’s one source of truth for what’s trusted. 3. Scope access per project and environment, so a test agent and a production agent don’t share the same permissions by default. 4. Enforce policy on tool calls at runtime, well after the initial review. A scan is a snapshot. A server that passed review in January can gain a new tool in March that nobody re-checks. That’s the same problem from the WhatsApp example, spread across a whole fleet of servers. Our MCP security solution https://www.enkryptai.com/solutions/mcp-security follows this model. The MCP scanner https://www.enkryptai.com/product/mcp-scanner finds and assesses risk before a server is adopted, and its findings inform your approved registry and policy defaults. The open-source MCP gateway https://www.enkryptai.com/product/mcp-gateway then enforces those decisions on every tool call at runtime. To see how we test agentic systems adversarially before they get this far, read about how our autonomous red-teaming agents work https://www.anaconda.com/blog/autonomous-ai-red-teaming . Secure your MCP servers Enkrypt AI by Anaconda https://www.anaconda.com/products/enkrypt-ai-by-anaconda scans MCP servers for vulnerabilities before they connect, then governs every tool call at runtime through one gateway. Explore Anaconda’s AI security & guardrails https://www.anaconda.com/platform/ai-security-and-guardrails . FAQ What is MCP security? MCP security is the set of practices, controls, and assessments used to protect implementations of the Model Context Protocol https://modelcontextprotocol.io/docs/getting-started/intro , the open standard that lets AI agents discover and call external tools, data sources, and services. Is MCP itself insecure? Not inherently, but it leaves key protections optional. Authorization is optional in the spec https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization , and the NSA notes https://www.nsa.gov/Portals/75/documents/Cybersecurity/CSI MCP SECURITY.pdf that it doesn’t require tokens to expire or rotate and only gives basic logging guidance. So each implementation decides how secure it is, and even official ones have had serious flaws, including Anthropic’s Git MCP server https://thehackernews.com/2026/01/three-flaws-in-anthropic-mcp-git-server.html and MCP Inspector https://www.oligo.security/blog/critical-rce-vulnerability-in-anthropic-mcp-inspector-cve-2025-49596 . See how a scan-and-enforce program addresses this https://www.enkryptai.com/solutions/mcp-security . What should developers do to build a secure MCP server? Validate parameters against what a tool is about to do, beyond checking the data type. Treat every tool’s output as untrusted. Sandbox execution with least-privilege access. Add session expiration, since the protocol doesn’t require it. And log every tool call, because MCP’s own logging guidance is basic. What’s the difference between an MCP Scanner and an MCP Gateway? A scanner finds vulnerabilities in a server before or after it’s adopted. A gateway enforces policy on tool calls at runtime, allowing, blocking, or modifying them as they happen. The scanner tells you what’s risky, and the gateway controls what’s happening right now. Has a government agency issued guidance on MCP? Yes. The NSA’s Artificial Intelligence Security Center published a Cybersecurity Information Sheet on MCP https://www.nsa.gov/Portals/75/documents/Cybersecurity/CSI MCP SECURITY.pdf in May 2026. It warns that adoption has outpaced security safeguards and recommends parameter validation, sandboxed execution, message signing, and continuous vulnerability tracking for MCP deployments.