RESOURCES · GUIDE

MCP Security: Risks and an Adoption Checklist

MCP gives AI agents hands. That is exactly why it deserves the same admission scrutiny as any supply chain component — and mostly is not getting it yet.

What MCP changes

The Model Context Protocol is an open standard that lets AI agents call external tools and data sources. It is becoming the integration layer of the agent era — and with that, a new class of supply chain component: MCP servers, distributed through registries and repositories, installed with a line of configuration, granted real credentials.

The three risk surfaces

• The server as a component. MCP servers are software you install from public sources — subject to the same poisoning, typosquatting and maintainer-takeover patterns as npm or PyPI packages, but younger, less reviewed, and typically running with broader permissions.
• Tool descriptions as an injection channel. Agents read tool metadata to decide what to call. Malicious or compromised descriptions can steer agent behavior — a form of prompt injection embedded in the supply chain itself.
• Indirect injection through content. Anything the agent reads — web pages, documents, emails — can contain hidden instructions that the agent converts into tool calls with real-world effects, using your credentials.

A pre-adoption checklist

• Inventory: which MCP servers are in use, from which sources, at which versions — an AI-era extension of the SBOM discipline.
• Capability audit before enablement: what can each tool actually do (file access, network reach, shell execution, secret access) — and does the declaration match the implementation?
• Least privilege: scope credentials per server; no shared org-wide tokens.
• Human confirmation on sensitive actions: payments, deletions, external sends.
• Injection screening on agent-readable content in high-stakes workflows.
• An admission gate: block / need-review / pass verdicts before a server or skill reaches your internal marketplace.

Where tooling fits

This is the gap SkillSec was built for: static capability auditing of Agent Skills and MCP ecosystems — seven risk domains, evidence graded to the line number, verdicts that plug directly into admission workflows. For the wider AI supply chain picture, see our analysis of agent supply chain poisoning.

FAQ

Is MCP itself insecure?

The protocol is neutral. The risk lives in the ecosystem around it: who wrote the server you are installing, what its tools can do with your credentials, and what text your agent reads.

How is auditing an MCP server different from malware scanning?

Malware scanning asks 'is it malicious?' Capability auditing asks 'what can it do?' — a fully benign server can still exfiltrate secrets or reach third parties with your credentials. Admission decisions need the second question.