MCP Security Basics: Risks and Protections for AI Agents

Introduction

AI agents are doing more than answering inquiries now. They can read files, query databases, send messages and activate workflows. Much of that capability comes from the Model Context Protocol, or MCP, which allows agents to connect to external tools and data, via MCP servers.

That convenience introduces a new attack surface. Gartner's 2026 Hype Cycle for Application Security changed the entry from "Model Context Protocol" to MCP Cybersecurity in July 2026. That's a shift from implementing the protocol to conserving it. AI Agent Identity is also included in the list of growing advancements in the report. Both signal coverage holes that many security teams have yet to address.

This guide provides the essentials for those unfamiliar to the topic.

What Is an MCP and Why Is It Important for Security?

• What it is: MCP is a common mechanism for AI agents to find and use tools like a calendar, code repository, or customer database.

• Why it's valuable: One agent can speak to several systems via a common interface, accelerating integration.

• Why it's risky: Each connected tool extends the agent capabilities. If your connection is compromised or misconfigured, that capability can be turned against you.

• The core change: Traditional controls like WAFs and static scanners were developed for human written code and predictable API traffic. Agents operate independently, at machine speed, and determine at runtime what to invoke.

What Gartner is Saying

• MCP Cybersecurity is a new category, with great benefit. Gartner now considers MCP connections an attack surface unto themselves.

• The paper outlines poisoned tool definitions, hijacked tool calls and lacking access control over which agents can call which tools as threats.

• Headline: Access control Gartner anticipates that over half of successful assaults against AI agents will be executed via access control issues through 2029.

• Early market: Guardian Agents, AI agents that manage other agents, are still in the early phase with very low adoption.

(Source: vendor write-up of the Gartner report. For specific wording and ratings consult the original Gartner report.

Risk 1: Prompt Injection

• The idea: An attacker inserts commands into content the agent takes in, such as a web page, email, document, or tool output. The model could interpret the instructions as legitimate commands.

• Why it is hard: Models cannot distinguish trusted instructions from untrusted data reliably. Both come as text.

• Direct vs indirect. Direct injection is the input of the user itself. The user may never see indirect injection, because it is buried in the third party material that the agent retrieves.

• Impact: A hijacked agent can leak data, call tools it shouldn't, or conduct activities the user never approved.

• First line of defense: Assume all retrieved content is untrusted, examine inputs and outputs, and demand human approval for sensitive activities.

Risk 2: Tool Contamination

• The idea: Write a name, description or schema of an MCP tool to hold harmful instructions. The agent reads in the typical setting.

• Why it's dangerous: The model reads tool definitions, but users seldom do.

• Rug pulls: A server could look safe at initial approval and then modify its definitions later.

• Initial Defenses: Review tool definitions before accepting a server, pin versions and notify on any change to a tool's description or behavior.

Risk 3: Too Many Permissions

• The idea: Agents have broad access "so things just work," including complete read/write on a drive or an admin level token or all the tools on a server.

• Why it's important: If the agent is compromised then the attacker will inherit all of the permissions of it. Wide access makes a little crack a big hole.

• The Gartner Connection: Gartner believes this will be the access control weakness that will drive the majority of successful agent assaults.

• First defenses: Use least privilege, limit access per tool and per task, and use short-lived narrowly scoped credentials instead of long-lived admin keys.

Risk 4: Fragile Agent Identity

• The notion: Many agents share credentials or generic service accounts or no particular identity at all.

• Why it matters: If five agents are using one token, you have no way of knowing which one did, you can't cancel one without revoking the others, and you can't create a clear audit trail.

• The Gartner connection: AI Agent Identity is listed as a gap in most AI installations and is on the rise.

• First line of defense: provide each agent an identity, associate each tool invocation with that identity and the person for whom it functions, and log it.

Risk 5: Malicious or Untrusted MCP Servers

• The concept: is that anyone can publish an MCP server. A compromised or look-alike server might stealthily leak data or offer malicious answers.

• Supply chain parallel: Consider this as dangerous packages in software dependencies, but for agent tooling.

• First lines of defense: Maintain an inventory of approved, vetted servers, prefer trusted publishers, and default to blocking unapproved connections.

Risk 6: Data Spillage and Overexposure

• The idea: tool outputs might have more information than needed for the task, and agents might leak sensitive data to other tools or logs.

• Why it matters: Once data is inside an agent's context, it can be repeated, summarized, or transmitted to somewhere unforeseen.

• First defenses: Limit tool output, redact sensitive fields, and restrict which tools can send data out.

Risk 7: No Visibility and Auditing

• The Concept: If you can't see what agents are calling and why, you can't spot misuse or investigate an event.

• Why this matters: Agent activity happens over multiple phases, therefore a single request log will rarely convey the whole story.

• First defenses: Log every tool invocation with identity, arguments and result. Track over whole sessions, not just individual requests.

A Handy Starting Checklist

• Inventory: List all MCP servers and agents in use, including those that teams have set up themselves.

• Approve and catalog: Only allow servers that have been checked and check the definitions of their tools.

• Least privilege: Limit each agent to the fewest tools and data it needs to do its job.

• Unique identities: one agent, one identity; credentials should be short-lived and revocable.

• Human in the loop: Require confirmation before harmful, costly or outwardly visible activities.

• Runtime monitoring: Check inputs, outputs, and tool calls as they happen and log everything.

• Test adversarially: Conduct red-team exercises with injected instructions and poisoned tools before the attackers do.

• Plan for change: Review servers and permissions regularly. Tools and agents change.