MCP Security
MCP lets a model reach external tools through one standard protocol, which solves the “write an adapter for every tool, for every agent” problem — but the same protocol turns the tool itself into a new attack surface.
This section starts with MCP fundamentals, then works through tool poisoning, command injection, excessive permissions and information leakage one by one, mapping each to the OWASP MCP Top 10 and giving concrete configuration and implementation guidance.
This section currently holds the articles below, in suggested reading order.
-
MCP Security Series: MCP Basics
A key part of an Agent is its ability to call external tools to get things done. For example, you could ask an Agent to plan a route from A to B for tomorrow, find restau…
-
MCP Security Information Leakage
The first risk in MCP, when translated literally, is actually called improper token management and key leakage. For the sake of convenience, we will simply refer to it as…
-
MCP Security Series: Excessive Permissions
This category of issue refers primarily to MCP tools having overly broad permissions and failing to follow the principle of least privilege. It shares the same underlying…
-
MCP Security Series: Tool Poisoning
The tool poisoning risk in MCP security actually revolves around malicious MCPs. For example, when the MCP server's code is malicious, or when an MCP tool's description c…
-
MCP Security Series: Command Injection
Command injection means the MCP server itself is vulnerable to command injection and similar flaws. The malicious commands it executes can come from many sources: a user…
-
MCP Security Series: Intent Flow Subversion
Intent flow subversion occurs when the model is supposed to perform task A, but we inject instructions that cause it to perform task B instead, or to tamper with the outc…
-
MCP Security Series: Authentication and Authorization Flaws
Authentication and authorization flaws broadly come down to permission problems in MCP services. Here are a few scenarios: