MCP security is the discipline of protecting AI agents, and the enterprise systems they touch, from threats introduced through the Model Context Protocol surface. It covers agents being persuaded to misuse tools or leak data to third-party services, malicious servers injecting instructions into agents, and shadow or rogue servers operating inside the network.
- Protects agents and enterprise systems from threats over the MCP surface
- Three vectors: agent-to-MCP, MCP-to-agent, and infrastructure risk
- Servers installed from public registries enter the agent's reasoning loop
- Tool poisoning and rug pulls are known patterns, not hypotheticals
Why is MCP security important?
MCP security matters because adoption is moving faster than enterprise security teams can baseline. Developers install MCP servers from public registries, agents consume tool lists at runtime, and the supply chain enters the agent's reasoning loop without passing a security review at any point.
The sequence is what makes it difficult. A conventional software dependency is reviewed before it ships. An MCP server is discovered by an agent at runtime, and its tool descriptions become input to the model's decision-making immediately. There is no build step at which to insert a gate, which means the control has to sit in the traffic.
The threat model spans known attack patterns and emerging ones the industry is still cataloging. Tool poisoning embeds instructions in tool descriptions. Rug pulls change a server's behavior after it has been trusted and adopted. Prompt injection arrives through tool descriptions and tool outputs rather than user input. New variants keep appearing, which argues for inspecting the protocol rather than maintaining a list of known-bad servers.
What is MCP security?
MCP security is the set of controls applied to the Model Context Protocol surface so agent tool use can be governed. Its scope is the traffic between agents and servers, plus the inventory of servers themselves.
Three attack vectors define it. Agent-to-MCP risk covers agents persuaded to misuse tools or leak data to third-party MCP services – the agent is the compromised party and the server is the destination. MCP-to-agent risk covers malicious servers injecting harmful instructions or poisoning tool lists, where the server is the attacker and the agent is the victim. Infrastructure risk covers shadow or rogue MCP servers running inside the network with elevated privileges, which is a discovery problem before it is a policy problem.
The three need different controls. Outbound misuse needs inspection of tool calls and data. Inbound manipulation needs inspection of tool list responses. Rogue infrastructure needs scanning to find servers nobody registered.
Types of MCP security controls
Controls group by which of the three vectors they address, and a program generally needs all three.
Discovery controls find MCP servers across the environment, including local servers on developer machines and remote servers reached over HTTP. Without this, the other controls apply to a partial inventory.
Sanctioning controls decide which servers agents may reach at all, allowing or denying by policy. This is the highest-leverage control and the cheapest to operate, because it removes whole categories of risk before any traffic flows.
Runtime controls inspect the traffic itself: tool calls before execution, tool list responses before the model reads them, and data moving in either direction. This is where prompt injection through tool descriptions, package provenance, and sensitive data protection are enforced.
Authentication controls establish per-server identity and per-session credentials, so an agent's access to one server does not imply access to another and a compromised session does not carry forward.
MCP security & Onyx
Onyx delivers MCP security across four shipping capability areas. Discovery is handled by the MCP Scanner, which identifies servers across the environment. Sanctioning lets administrators allow or deny MCP servers by policy. Runtime protection is delivered by the MCP Gateway, which brokers tool calls with prompt injection inspection, tool restrictions, package provenance, sensitive data protection, and scoped enforcement. Authentication controls provide per-server identity and per-session credentials.
One scope note, stated plainly because it matters in an evaluation: CVE scanning of MCP servers is not part of the shipping MCP security scope. Vulnerability management for the software an MCP server is built from remains a separate discipline. MCP security covers the protocol surface and the traffic across it.
