AI assistants used to just talk. Now, through the Model Context Protocol, they can act: read files, call APIs, query databases, and run tools. That is a genuine leap in usefulness, and it quietly opens a new attack surface most teams have not secured yet.
What MCP is, in one paragraph
MCP is an open standard that connects an AI agent to external tools and data. A tool advertises what it does through a description, the agent decides when to call it, and the tool returns output the agent reads. Each of those three steps, the description, the call, and the output, is a place where a determined attacker can interfere.
Why MCP changes the security picture
In a normal app, code decides what runs. With an AI agent, natural language decides what runs, and the agent trusts text it is given. If an attacker can place text where the agent will read it, they can influence what the agent does. That is the heart of the problem.
The five risks that matter most
- Tool poisoning: hidden instructions buried in a tool description that the agent follows
- Prompt injection through tool output: a tool returns text that hijacks the agent
- Hidden-Unicode steganography: invisible characters that smuggle instructions past human review
- Secret exposure: API keys and tokens left in plain text in server config
- Unsafe stdio launch: tools launched with shell commands that can be abused to run arbitrary code
How to secure an MCP deployment
- Allow-list which servers and origins your agent may connect to
- Review every tool description before you trust it, the same way you review code
- Never treat tool output as instructions, only as data
- Keep secrets out of config files, use a secret manager and environment isolation
- Scan tool manifests and server configs before they ship, not after
Scan it, do not assume it
Most of these issues are invisible to a quick glance, which is exactly why they are dangerous. We built MCP Shield, a free and open-source MIT-licensed scanner, to catch tool poisoning, prompt injection patterns, hidden-Unicode payloads, secret exposure, and unsafe launch patterns automatically. It is the kind of check that should run before any MCP server reaches production.
MCP is going to be everywhere, the same way APIs are. The teams that treat its security as a first-order concern now will avoid the breaches that the rest learn about the hard way. Build secure, then connect.