MCP Security: 8 Key Risks and 10 Essential Best Practices

• Prompt injection: Malicious text in data or user inputs tricks AI agents into executing harmful tool calls or exposing private data.
• Malicious or compromised MCP servers: Hostile or compromised servers can manipulate responses, expose secrets, misrepresent tools, or influence agent behavior.
• Tool poisoning: Misleading tool descriptions or metadata can cause agents to invoke tools that perform hidden or unexpected actions.
• Excessive agent permissions: Broad access to files, databases, APIs, or production systems increases the impact of compromised or manipulated agents.

• Unauthorized tool execution: Agents may perform sensitive actions without adequately verifying user intent or obtaining required approval.
• Sensitive data leakage: MCP resources can expose confidential information through model responses, logs, tool calls, or transfers to other services.
• Credential and token exposure: API keys, access tokens, database credentials, and other secrets can leak through insecure configuration, logs, errors, or tool responses.
• Confused deputy attacks: Attackers can trick privileged agents or MCP servers into accessing protected resources on behalf of users who lack the required permissions.

• Maintain an MCP inventory: Track MCP servers, clients, tools, resources, owners, deployment locations, authentication methods, and connected systems.
• Use approved and trusted MCP servers: Review server maintainers, code, dependencies, permissions, update practices, and connected systems before approval.
• Apply least privilege to every tool: Restrict each tool to the resources and read, write, delete, or administrative permissions required for its task.
• Require approval for high-impact actions: Add human confirmation before destructive, sensitive, externally visible, or difficult-to-reverse operations.
• Treat retrieved content as untrusted: Prevent tool outputs, documents, websites, databases, and other external content from automatically triggering privileged actions.

• Use short-lived, scoped credentials: Store secrets securely and limit tokens by user, tool, resource, operation, or session where possible.
• Validate MCP and backend requests: Check schemas, parameters, destinations, operations, authorization context, and data formats before execution.
• Apply rate and resource limits: Restrict tool calls, concurrent operations, execution time, API consumption, and other expensive resources.
• Protect MCP-connected APIs: Use API security, bot detection, traffic filtering, rate limiting, and DDoS mitigation against automated attacks.
• Centralize MCP security logging: Record and correlate tool calls, authentication events, authorization decisions, agent activity, parameters, and affected resources.

• Why is MCP Security Important?
• Common MCP Security Risks and Issues
• Key MCP Security Controls

• MCP Security Best Practices
• Securing MCP Tools and AI Agents with Radware Agentic AI Protection

MCP Can Give AI Agents Access to Sensitive Enterprise Systems

MCP servers can connect AI applications to internal databases, source code repositories, file systems, cloud services, and business applications. This access may expose credentials, customer records, proprietary code, financial data, or operational information. If permissions are too broad, a compromised agent or malicious prompt could retrieve data that the user was never meant to access.

The risk is higher when the same MCP connection is available across many users or workflows. An agent may inherit access from a service account with wider permissions than the person making the request. Organizations therefore need to enforce least-privilege access, separate sensitive environments, and ensure that authorization is checked for every request rather than assumed from the initial connection.

Agents Can Trigger Actions Instead of Only Generating Text

MCP tools can allow an AI agent to perform actions such as modifying files, sending messages, updating records, deploying code, running commands, or calling external APIs. This changes the security model because incorrect or malicious tool calls can affect real systems. A generated response can be reviewed before use, but an executed action may have immediate consequences.

For example, an agent with write access could delete records, change configurations, or send information to an external service if it receives a harmful instruction. Sensitive operations should therefore require stronger controls, such as scoped permissions, parameter validation, user confirmation, rate limits, and detailed audit logs. High-impact actions may also need human approval before execution.

Related content: Read our guide to agentic AI security.

An MCP server may be reused by several AI applications or agents. If that server is compromised, an attacker could manipulate tool responses, expose data, steal credentials, or provide malicious instructions to every connected client. This makes the server a shared trust boundary rather than an isolated integration.

The impact can increase when clients automatically trust tool descriptions, returned content, or server-provided metadata. A malicious server could attempt to influence agent behavior or cause additional tool calls through crafted responses. Organizations should verify server provenance, restrict network and data access, keep dependencies updated, monitor server behavior, and isolate high-risk integrations so one compromised server cannot affect the entire AI environment.

Related content: Read our article about AI security

1. Prompt Injection Through MCP-Connected Content

MCP can expose agents to untrusted content from:

• Files
• Websites
• Databases
• Issue trackers
• Other external systems

Attackers can place hidden or explicit instructions in that content to influence the model. An agent may then treat the injected text as instructions instead of data. This can lead to unauthorized tool calls, disclosure of sensitive information, or changes to normal agent behavior. MCP clients should treat retrieved content as untrusted, separate data from instructions, and apply additional validation before allowing content to trigger privileged actions.

2. Malicious or Compromised MCP Servers

An MCP server may be intentionally malicious or become compromised after deployment. A hostile server can:

• Return manipulated data
• Expose secrets
• Misrepresent available tools
• Attempt to influence how the agent behaves

The risk is greater when organizations connect third-party servers without reviewing their code, dependencies, or permissions. MCP servers should be treated like other external services: verify their source, restrict their access, isolate them where possible, and monitor their behavior for unexpected changes.

3. Tool Poisoning and Misleading Tool Descriptions

MCP tools include metadata that tells the model what each tool does and when it should be used. A malicious server can provide misleading descriptions designed to make a tool appear safer or more useful than it actually is.

For example, a tool described as reading a document might also transmit its contents to an external service. Tool descriptions should not be treated as a security control. Clients should independently validate tool behavior, restrict tool permissions, and avoid granting sensitive capabilities based only on server-provided metadata.

4. Excessive Agent Permissions

Agents may receive broader access than they need to complete a task. An MCP server might run with permission to:

• Read an entire file system
• Access multiple databases
• Modify production resources

This may happen even when the agent only needs a small subset of that access. Excessive permissions increase the impact of prompt injection, configuration errors, and compromised components. Organizations should apply least privilege, use narrowly scoped service accounts, separate read and write permissions, and limit access by resource, environment, and operation.

5. Unauthorized Tool Execution

An agent may execute an MCP tool without sufficient confirmation from the user or without verifying that the action matches the user's intent. This is especially risky for tools that:

• Send messages
• Modify data
• Run commands
• Interact with production systems

High-impact actions should require explicit authorization and additional checks before execution. Clients can also enforce allowlists, validate tool parameters, and require human approval for destructive, irreversible, or externally visible operations.

6. Sensitive Data Leakage Through MCP Resources

MCP resources can expose documents, logs, database records, source code, and other information to an AI application. If access controls are weak, the model may retrieve or include sensitive data in:

• Responses
• Logs
• Tool calls
• Downstream requests

Data leakage can also occur indirectly when an agent sends retrieved information to another MCP tool or external service. Security controls should limit which resources can be accessed, classify sensitive data, filter outputs where appropriate, and prevent unnecessary transfer of information between tools.

7. Credential and Token Exposure

MCP servers often require API keys, access tokens, database credentials, or other secrets to connect to external systems. Poor secret handling can expose these credentials through:

• Configuration files
• Environment variables
• Logs
• Error messages
• Tool responses

Credentials should be stored in dedicated secret-management systems and never returned to the model unless absolutely necessary. Tokens should be short-lived and narrowly scoped, and organizations should rotate credentials regularly and revoke them quickly if compromise is suspected.

8. Confused Deputy Attacks

A confused deputy attack occurs when an agent or MCP server has legitimate access to a protected resource but is tricked into using that access on behalf of an unauthorized party. The component performing the action may have permission, while the user or request that triggered it does not.

For example, an agent could be persuaded to use its database credentials to retrieve information that the requesting user cannot access directly. MCP implementations should:

• Preserve user identity and authorization context across tool calls
• Verify permissions for each operation
• Avoid relying only on the privileges of the server or agent

MCP Server and Tool Discovery

Organizations need visibility into which MCP servers and tools are available to agents. A discovery process helps identify unauthorized, outdated, or high-risk integrations before they are used. This can include maintaining an inventory of approved servers, their owners, exposed tools, permissions, and connected systems.

Discovery also makes it easier to detect shadow MCP deployments that bypass normal security review. Security teams can then evaluate each server's trust level, data access, and operational impact before allowing it into production workflows.

Strong Authentication

MCP connections should verify the identity of users, clients, and servers before granting access. Strong authentication reduces the risk of attackers impersonating trusted components or using stolen credentials to access MCP tools.

Depending on the environment, this may involve OAuth, mutual TLS, short-lived tokens, workload identities, or other strong authentication methods. Credentials should be rotated regularly and should not be embedded directly in source code or configuration files.

Fine-Grained Authorization

Authentication confirms identity, but authorization determines what that identity can do. MCP deployments should enforce permissions at the level of individual tools, resources, actions, and environments instead of granting broad access to an entire server.

For example, one agent may only need read access to a reporting database, while another may require limited write access to a specific table. Fine-grained authorization reduces the impact of prompt injection, account compromise, or accidental misuse.

Tool Allowlisting

Tool allowlisting limits agents to a predefined set of approved MCP tools. Instead of exposing every capability offered by a server, organizations can explicitly permit only the tools required for a given workflow.

Allowlists can be applied by user, agent, environment, or task type. They are especially useful for preventing access to destructive or high-risk tools, such as those that modify production systems, execute shell commands, or send data to external services.

Input and Output Validation

MCP clients and servers should validate data before it is accepted or passed to another component. Input validation can detect malformed parameters, unexpected commands, unsafe file paths, or values that fall outside approved ranges.

Output validation is equally important because MCP servers may return untrusted or manipulated content. Responses should be checked for sensitive data, invalid formats, or content that could trigger unsafe downstream actions before being passed back to the model or another tool.

Runtime Tool Execution Monitoring

Organizations should monitor MCP tool calls while agents are running. Useful telemetry includes which tool was called, who initiated the request, what parameters were used, which resources were accessed, and whether the action succeeded.

Runtime monitoring can detect unusual behavior such as repeated access attempts, unexpected tool sequences, or actions outside normal operating patterns. Logs should be detailed enough to support incident investigation without unnecessarily recording sensitive data.

Rate limits prevent agents or compromised clients from making an excessive number of tool calls in a short period. They can reduce the impact of runaway loops, denial-of-service attempts, automated abuse, and unexpectedly expensive operations.

Resource controls can also restrict execution time, memory use, API consumption, file access, and concurrency. These limits provide an additional containment layer when an agent behaves incorrectly or a malicious request reaches an MCP tool.

1. Maintain an Inventory of MCP Servers, Clients, Tools, and Resources

Maintain a continuously updated inventory of all MCP servers, clients, exposed tools, connected resources, and backend systems. The inventory should document ownership, business purpose, deployment location, authentication method, and the systems or data each component can access.

A complete inventory helps security teams understand the MCP attack surface and identify unauthorized, outdated, or abandoned components. It also makes incident response faster by showing which agents, tools, APIs, and resources may be affected when a server, credential, or integration is compromised.

Key actions:

• Inventory all MCP servers, clients, tools, resources, and backend systems.
• Record ownership, business purpose, deployment location, and authentication method.
• Document the systems and data each component can access.
• Identify and remove unauthorized, outdated, or abandoned components.

2. Use Only Approved and Trusted MCP Servers

Restrict enterprise AI applications to MCP servers that have gone through a formal security review and approval process. Evaluate who maintains the server, how it is distributed, which dependencies it uses, how frequently it is updated, and whether it follows secure authentication and authorization practices.

Organizations should also review what external systems each server can access and how much trust is placed in its tool definitions and responses. Previously approved servers should be reassessed when their ownership, code, dependencies, permissions, or deployment model changes.

Key actions:

• Require security review before approving MCP servers.
• Review server maintainers, distribution methods, dependencies, and update practices.
• Assess authentication, authorization, permissions, and connected external systems.
• Reassess servers when their code, ownership, dependencies, or permissions change.

3. Apply Least Privilege to Every MCP Tool

Grant each MCP tool only the permissions required to perform its intended task. Separate read, write, delete, and administrative privileges, and limit access to specific databases, repositories, files, cloud resources, or API functions wherever possible.

Least privilege reduces the damage that can occur if an agent is manipulated through prompt injection or if an MCP server or tool is compromised. A tool that only needs to read a narrow set of records should not be able to modify production systems or access unrelated sensitive information.

Key actions:

• Grant tools only the permissions required for their intended tasks.
• Separate read, write, delete, and administrative privileges.
• Restrict access to specific files, databases, APIs, repositories, and cloud resources.
• Remove permissions that are unrelated to the tool's approved function.

4. Require Explicit Approval for High-Impact Actions

Require human confirmation before an AI agent performs sensitive, destructive, or difficult-to-reverse actions. Examples include deleting data, changing security configurations, deploying code, modifying production infrastructure, transferring money, creating privileged accounts, or sending external communications.

Approval checkpoints provide an additional layer of control when an agent misinterprets instructions, follows malicious content, or invokes the wrong tool. Organizations can apply stricter approval requirements based on the sensitivity of the target system and the potential impact of the action.

Key actions:

• Require human confirmation for sensitive or destructive operations.
• Add approval checkpoints for production changes and privileged account creation.
• Require confirmation before financial transactions or external communications.
• Apply stricter approval requirements as potential impact increases.

5. Treat Tool Outputs and Retrieved Content as Untrusted

Treat information returned by MCP tools, websites, documents, databases, email systems, and external services as potentially untrusted input. Retrieved content may include false information, malicious instructions, or embedded prompt injection designed to influence an AI agent's behavior.

Agents should clearly separate trusted system instructions from external content and should not automatically follow commands contained in tool outputs. Sensitive actions triggered by retrieved information should be independently validated before the agent invokes additional tools or makes changes to enterprise systems.

Key actions:

• Treat external and tool-provided content as potentially malicious.
• Separate retrieved content from trusted system instructions.
• Do not automatically execute instructions contained in tool outputs.
• Independently validate sensitive actions triggered by retrieved information.

6. Protect Credentials with Short-Lived, Scoped Tokens

Avoid storing long-lived API keys, passwords, or broadly privileged credentials in MCP configurations, agent prompts, or local files. Prefer short-lived tokens that are narrowly scoped to a specific user, tool, resource, operation, or session.

Credentials should be stored in dedicated secret-management systems, rotated regularly, and revoked when they are no longer required. Short-lived and limited-scope tokens reduce the amount of access an attacker gains if a credential is exposed through logs, compromised tools, or insecure MCP infrastructure.

Key actions:

• Scope credentials to specific users, tools, resources, operations, or sessions.
• Store credentials in dedicated secret-management systems.
• Rotate credentials regularly and revoke them when no longer required.

7. Validate MCP Traffic and Backend API Requests

Validate MCP requests before they are forwarded to backend APIs, databases, applications, or cloud services. Check request schemas, parameter types, destinations, allowed operations, data formats, and authorization context, and reject malformed or unexpected requests.

Backend services should also enforce their own authentication and authorization controls rather than trusting requests simply because they came through an approved MCP server. Independent validation helps prevent forged requests, privilege escalation, injection attacks, and misuse of legitimate MCP tools.

Key actions:

• Validate request schemas, parameters, destinations, operations, and data formats.
• Verify authorization context before forwarding requests.
• Reject malformed, unexpected, or unauthorized requests.
• Enforce authentication and authorization again at backend services.

8. Apply Rate Limits and Resource Consumption Controls

Set limits on the number of tool calls, API requests, concurrent operations, execution time, and other expensive resources that an agent can consume. These controls help prevent runaway loops, accidental recursion, automated abuse, and unexpected cloud or API costs.

Rate limits can be applied by user, agent, tool, API endpoint, or workflow depending on the risk. Organizations should also monitor sudden increases in tool usage or resource consumption because abnormal activity may indicate a compromised agent, malicious automation, or an attempted denial-of-service attack.

Key actions:

• Limit tool calls, API requests, and concurrent operations.
• Restrict execution time and other expensive resources.
• Apply limits according to user, agent, tool, endpoint, or workflow risk.
• Monitor sudden increases in tool usage and resource consumption.

9. Protect MCP-Connected APIs Against Bots and DDoS Attacks

APIs connected to MCP infrastructure remain exposed to many of the same automated threats as other application interfaces. Attackers may use bots, request floods, credential abuse, or application-layer attacks to overload MCP-facing services or the backend APIs they depend on.

Apply API security controls, behavioral bot detection, rate limiting, traffic filtering, and DDoS mitigation across the MCP architecture. Monitoring request patterns and automatically blocking malicious traffic can help maintain availability while preventing automated attacks from exhausting application, network, or compute resources.

Key actions:

• Apply API security controls across MCP-facing and backend services.
• Use behavioral detection to identify malicious automated traffic.
• Enforce rate limits and traffic filtering against abusive requests.
• Apply DDoS mitigation to protect network and application resources.

10. Log Tool Calls, Authentication Events, and Agent Actions

Record MCP tool invocations, authentication attempts, authorization decisions, agent identities, request parameters, target resources, and resulting actions wherever appropriate. Logs should include enough context to reconstruct what an agent attempted to do and which systems were involved.

Centralize this telemetry so security teams can correlate activity across MCP servers, clients, APIs, and backend services. Comprehensive logging supports threat detection, incident investigation, compliance auditing, and the identification of unusual behavior such as repeated denied actions, abnormal tool usage, or unexpected access to sensitive resources.

Key actions:

• Log tool calls, authentication attempts, and authorization decisions.
• Record agent identities, request parameters, target resources, and resulting actions.
• Centralize telemetry across MCP clients, servers, APIs, and backend services.
• Monitor logs for denied actions, unusual tool usage, and unexpected resource access.

• MCP tool control: Allows or blocks tools as needed for each agent, limiting agents to the tools they are approved to use.
• Agent and tool discovery: Continuously discovers all types of agents and tools across environments, providing visibility into the entire agent ecosystem, including agents, tools, and interactions.
• Agent relationship mapping: Maps agent connections and dependencies, with rich metadata on agent configuration, usage, and tools.
• LLM guards: Builds guardrails to protect against prompt injection, jailbreaks, and unsafe outputs, with independent testing showing up to 95.7% effectiveness against indirect prompt injection attacks.
• Agent behavioral protection: Maintains runtime monitoring of agent actions and intents, monitoring tool calls and blocking goal-divergent actions, and responding in real time to threats such as indirect prompt injection, jailbreaking, and supply chain attacks.

• Agent behavior analytics: Tracks usage trends, anomalies, and performance changes across agent activity, model usage, and tool interactions.
• Real-time security posture: Identifies and scores risks across agents and tools, continuously monitoring risks throughout the agent lifecycle across SaaS, homegrown, and end-user devices.
• Full execution risk graph mapping: Captures agent workflows across all AI environments to clearly identify the source of risk.
• Developer-hosted agent protection: Monitors, detects, and secures AI agents running on the client side, including Claude Code agents.
• Posture management reports: Generates audit-ready reporting to demonstrate compliance with global standard requirements.