Model Context Protocol (MCP)
An open protocol that standardizes how AI models connect to external tools, data sources, and services, letting any compliant model use any compliant tool server.
Why it matters
Before standardization, every AI-to-tool integration was custom glue. MCP matters because it turns tools into an ecosystem: businesses can expose their systems to AI assistants once and work with many models. It equally matters for security: a standard connection layer concentrates risk, so vetting MCP servers becomes as important as vetting software dependencies.
How it works
An MCP server declares tools (functions with names, descriptions, and schemas), resources, and prompts. A client (the AI application) connects, lists what is available, and the model decides when to invoke tools during a conversation. Transport is typically local stdio or HTTP. Because the model reads tool descriptions as text, those descriptions are part of the attack surface, and launch configurations and credentials need the same care as any service deployment.
A real-world example
A business connects its AI assistant to an MCP server exposing 'search customer records' and 'create support ticket'. The assistant can now resolve a complaint end to end. If that server came from an unvetted source, however, a poisoned description could redirect the same capabilities, which is why registration-time scanning exists.
Common mistakes
- ✗ Treating MCP servers as harmless plugins instead of privileged software dependencies
- ✗ Running servers with credentials far broader than the tools require
- ✗ Skipping review of tool descriptions, the part the model actually obeys
- ✗ Exposing sensitive internal systems without human gates on consequential actions
Best practices
- ✓ Scan servers for tool poisoning and injection patterns before connecting them
- ✓ Pin versions; re-scan on updates like any dependency bump
- ✓ Scope credentials per server to the minimum its tools genuinely need
- ✓ Prefer reputable, auditable servers and read the schema of anything else
Frequently asked questions
Is MCP tied to one AI vendor?
It is an open protocol with multi-vendor adoption; that neutrality is why an ecosystem of servers exists, and why supply-chain hygiene around them matters.
Should a business build its own MCP server?
If AI assistants should act on your systems, yes, a scoped server you control beats granting a third-party tool broad API keys. Build it least-privileged with logging from day one.
What are the main security risks with MCP?
Poisoned tool descriptions, prompt injection through returned content, secret exposure in configurations, and unsafe launch patterns. All are scannable and manageable with discipline.
AEGIBIT built MCP Shield after studying real MCP attack disclosures: an open-source scanner and runtime firewall for exactly this layer.
MCP Shield by AEGIBIT →