- Home
- AI agents
- Tools, MCP and agent-to-agent
- MCP security
Build · Tools, MCP and agent-to-agent
MCP security: risks, incidents and the controls to set up
MCP security is the set of controls that stop an agent’s tool connections from being abused: hidden instructions in tool descriptions, prompt injection through tool results, servers that forward tokens meant for another service, over-broad scopes, and malicious server packages. The fixes sit outside the model: a gateway, allow lists, scoped tokens, pinned tool lists and approval for writes.
In this guide: 83 pages
Key takeaways
- Several of the documented MCP incidents needed no bug: an agent with private data, an untrusted input and an outbound channel, plus a tool call. Remove one leg or add a human gate.
- Tool descriptions and annotations are text the model reads. Pin the tool list at approval, re-review on change, and never treat readOnlyHint as enforcement.
- The 2026-07-28 spec closes the token holes it can: audience-bound tokens, PKCE, no passthrough, issuer validation. The official SDKs still shipped a cluster of high-severity fixes between December 2025 and October 2026, so pin and patch them.
- The OWASP MCP Top 10 (beta) is the public checklist for this topic; the controls on this page map onto it.
What are the main MCP security risks?
Eight risks cover the documented incidents and advisories, in four groups: text the model reads (tool descriptions and results), tokens and scopes, state and sessions, and the server supply chain. The table names each, the event that proved it and the control that answers it.
MCP risks, the public event that demonstrated each, and the control.
| Risk | How it works | Demonstrated by | Control |
|---|---|---|---|
| Tool poisoning, rug pull, shadowing | Hidden instructions in a description; a description changed after approval; one server’s description steers another server’s tools | Invariant Labs, 1 Apr 2025 | Pinned tool lists; review on change; descriptions treated as untrusted input |
| Injection through tool results (toxic flows) | Instructions in an issue, ticket, email or page the tool returns; private data leaves through a public channel | GitHub MCP exploit, 26 May 2025; Supabase MCP demo, 8 Jul 2025 | Allow list per agent; approval for writes; closed outbound channels; one repository or project per session |
| Annotations treated as security | readOnlyHint and destructiveHint are hints a dishonest server can misuse | MCP project guidance, 16 Mar 2026 | Read-only enforced at the gateway or in the token scope |
| Confused deputy | A proxy with a static client id, plus dynamic registration and a remembered consent cookie, yields an authorization code without the user’s consent | Spec security best practices, 2026-07-28 | Per-client consent; exact redirect_uri match; state validation; CIMD instead of dynamic registration |
| Token passthrough and audience confusion | A server accepts or forwards a token issued for another service, which bypasses controls and breaks the audit trail | TypeScript and Python SDK advisories, Oct 2026 | Audience validation; resource indicator; no transit of other tokens |
| Over-broad scopes | files:* or admin:* requested up front enlarges what a stolen token can do | Spec guidance; Stripe stops accepting full-access keys after 30 Nov 2026 | Least scope first; step-up through WWW-Authenticate; scoped agent keys |
| State and session hijacking | A stolen session id (2025) or state handle (2026) treated as authentication | SDK advisories of 5 Jun, 2 Oct and 15 Oct 2026 | Handles bound to the verified user, signed or encrypted |
| Malicious or buggy servers, server-side request forgery (SSRF), DNS rebinding | Impostor packages; OAuth discovery URLs pointed at internal hosts; local proxies driven from a web page | postmark-mcp, Sep 2025; CVE-2025-6514; CVE-2025-49596; DNS rebinding advisories, 2 Dec 2025 | Private registry; pinned SDKs; HTTPS only with private ranges blocked; egress proxy; install consent |
The OWASP MCP Top 10, in beta on 2 Nov 2026, covers the same ground under ten headings: token mismanagement and secret exposure, privilege escalation via scope creep, tool poisoning, supply chain, command injection, prompt injection via contextual payloads, insufficient authentication and authorization, lack of audit and telemetry, shadow MCP servers, and context injection and over-sharing.
Which MCP incidents and advisories should you know?
Eleven dated events between April 2025 and October 2026 explain every control on this page. Three were proofs of concept by researchers, one was a live bug in a vendor server, one was a malicious package, and the rest were advisories in the official SDKs and tooling.
MCP incidents and advisories, April 2025 to October 2026, from the researcher, vendor or advisory page named in the sources.
| Date | Event | What happened | Fix |
|---|---|---|---|
| 1 Apr 2025 | Tool poisoning (Invariant Labs) | Hidden text in a tool description made an agent read a private key file and pass it as a parameter; rug pull and shadowing variants described | Pinned tool lists; review of descriptions |
| 26 May 2025 | GitHub MCP toxic flow (Invariant Labs) | A malicious public issue steered an agent into leaking private repository data through a public pull request; Invariant called it an architectural problem rather than a server bug | Least privilege per session; runtime guardrails |
| 4 to 17 Jun 2025 | Asana MCP server exposure | A logic bug exposed data across organisations to other MCP users for over a month, about 1,000 customers affected; server taken offline and restored 17 Jun | Vendor fix; tenant isolation review |
| 27 Jun 2025 | CVE-2025-49596, MCP Inspector (CVSS 9.4) | An unauthenticated local proxy could be driven from a malicious web page to run commands | Fixed in 0.14.1 |
| 8 Jul 2025 | Supabase MCP demo (General Analysis) | A support ticket with hidden instructions led an assistant running with the service role, which bypasses row-level security, to read integration tokens and post them into the ticket | Read-only mode; one project; limited tool groups |
| 9 Jul 2025 | CVE-2025-6514, mcp-remote (CVSS 9.6) | A malicious server’s authorization endpoint led to operating-system command execution on Windows, versions 0.0.5 to 0.1.15 | Fixed in 0.1.16 |
| 17 Sep 2025 | postmark-mcp 1.0.16 (impostor package) | After 15 clean versions, the npm package copied every email to an attacker domain; 1,643 downloads before removal | Remove the package; rotate credentials sent by email |
| 2 Dec 2025 | SDK advisories: DNS rebinding | Both official SDKs had DNS rebinding protection off by default for localhost servers | Upgrade; enable protection |
| 5 Jun 2026 | Python SDK advisory | HTTP transports served session requests without verifying the authenticated principal | Upgrade |
| Sep 2026 | SDK advisories: OAuth and $ref | The OAuth client could send credentials to an authorization server chosen by the MCP server (both SDKs); the Python client fetched server-chosen $ref URLs while validating tool results (28 Sep) | Upgrade; validate discovery URLs |
| 2 to 15 Oct 2026 | TypeScript and Python SDK advisories | Experimental tasks not tied to the creating session (2 Oct); bearer authentication accepted tokens issued for another service (5 Oct); shared transports delivered one client’s messages to another (15 Oct) | Upgrade; audience validation |
This list covers the official SDK advisories and the researcher write-ups published by 2 Nov 2026; later incidents go in at the next review. One adjacent item belongs next to it: an AgentCore harness bug (CVE-2026-18830, 4 Aug 2026) let authenticated callers run configured tools without model mediation, and AWS fixed it server-side with no customer action.
What does the 2026-07-28 spec require, and what is still your job?
The spec fixes what a protocol can fix: how tokens are issued, bound and validated, how clients register, and how state handles are protected. It cannot fix what the model does with text it reads, which is why the gateway, the allow lists and approval stay your job.
On the spec’s side, in 2026-07-28: servers publish protected resource metadata and validate the token audience; clients use PKCE, send the resource parameter and validate the iss parameter when it is present; servers must not accept or transit any other tokens; OAuth proxies must implement per-client consent, exact redirect_uri matching and state validation; a state handle must never count as authentication and should be bound to the verified user; discovery URLs must be HTTPS with private IP ranges blocked; and a client that offers one-click local install must show the exact command and get consent first. Dynamic client registration is deprecated in favour of Client ID Metadata Documents and kept only for authorization servers without CIMD support; adopting CIMD removes the open-registration leg of the confused deputy.
On your side, the toxic flow has no server patch, so the control is architectural. Check each agent for the three legs (untrusted input, private data, an outbound channel), the check Meta’s agent security guidance frames as a rule of two, and remove one or add a human gate; scope sessions to one repository, project or tenant; close exfiltration paths with URL allow lists; and treat every tool description and result as untrusted text, which is what Microsoft’s guidance for the Foundry MCP tool says about provider-supplied descriptions. Tool annotations give reviewers a risk vocabulary; enforcement happens at the gateway.
Vendor features help on both sides. Anthropic’s mcp-client-2026-09-15 header pins each server’s tool list. AgentCore Gateway can use a static mcpToolSchema, and AgentCore Policy denies tool calls by rule (GA 3 Mar 2026). Google’s Model Armor scans MCP calls on managed servers (GA 22 Apr 2026) and on Agent Gateway (GA 24 Jun 2026). OpenAI requires approval for remote MCP tools by default and warns that remote servers are unverified and may change behaviour. Microsoft Defender for Endpoint discovers local MCP server configurations on Windows and macOS (macOS in preview), which is how shadow servers surface.
How do Microsoft, AWS and Google implement it?
The MCP-specific security features on each cloud, with statuses as the vendor pages showed on 2 Nov 2026.
Capability, Microsoft, AWS, Google
| Capability | Microsoft | AWS | |
|---|---|---|---|
| Policy on MCP tool calls | Foundry MCP tool approval modes and allowed tools; API Management policies; Copilot Studio external threat detection (preview; allows the call if no verdict within 1 second unless set to block) | AgentCore Policy, Cedar rules evaluated on each tool call (GA 3 Mar 2026); static tool schema on Gateway targets | Agent Gateway policies; semantic governance policies on tool calls (preview 29 Jun 2026); IAM Unified Access Policies for MCP servers (GA 31 Aug 2026) |
| Scanning of MCP traffic | Defender real-time protection for Agent 365 agents; Copilot Studio and Foundry agents in preview | No MCP-specific scanner named on the Gateway page; Bedrock Guardrails cover model input and output, AgentCore Policy the tool call | Model Armor on managed MCP servers (GA 22 Apr 2026) and on Agent Gateway (GA 24 Jun 2026) |
| Finding shadow MCP servers | Defender for Endpoint lists local agents and their MCP server configurations on Windows and macOS (macOS preview) | AWS Agent Registry auto-detects AgentCore Gateways across an Organization; servers elsewhere are registered by hand | Agent Registry registers supported workloads in a project; external servers by hand |
| Token handling | Entra identity, Entra user delegation or OAuth passthrough on the Foundry MCP tool; Entra JWT validation in API Management | Gateway outbound OAuth with token refresh and credential injection; inbound OAuth or IAM SigV4 | IAM allow and deny policies; OAuth with PKCE for agents imported into Gemini Enterprise |
Copilot Studio external threat detection, and Defender protection for Copilot Studio and Foundry agents, were preview on 2 Nov 2026.
What should you set up?
The MCP-specific controls, in the order we install them. The gateway and the agent identity from the topic page apply here unchanged.
- An allow list of servers per agent, enforced at the gateway, with the private registry as its source, so that a server without a record is unreachable.
- An allow list of tools per server per agent (OpenAI allowed_tools, Foundry MCP tool settings, AgentCore Policy), and a pinned tool list that a server change cannot alter without a review.
- Scoped tokens: audience-bound to one server, least scope first, step-up through WWW-Authenticate, short-lived, and separate for development and production. Enterprise-Managed Authorization where the identity provider supports it, so consent is set centrally.
- Approval for writes and payments: require_approval on OpenAI and Foundry, Microsoft 365 plugin confirmation for data-modifying calls, and vendor dashboard confirmation such as Stripe’s for sensitive actions.
- The three-leg check on every agent: untrusted input, private data, outbound channel. Scope sessions to one repository, project or tenant, and allow-list the URLs an agent may fetch or render.
- Runtime controls where the platform offers them: content scanning (Model Armor on Google, Defender real-time protection on Microsoft) and tool-call authorization by rule (AgentCore Policy on AWS), plus a log of every tool call with the agent identity and the token scope.
- Supply chain: official SDKs only, pinned and patched like a web framework; DNS rebinding protection on for local servers; HTTPS-only discovery with private ranges blocked; an egress proxy; consent before any one-click install; Defender for Endpoint discovery of local server configurations.
- Injection cases in the evaluation gate: a poisoned issue, ticket, email and page, re-run whenever a server, a tool list or a model changes.
Frequently asked questions
Is an MCP server secure?
A server is as secure as its authorization, its tool descriptions and the gateway in front of it. The protocol now requires audience-bound tokens, PKCE and no passthrough, which addresses the token-level risks where a server implements them correctly; the content-level risks, poisoned descriptions and injected results, need a gateway, pinned tool lists, allow lists and approval for writes.
What are the top MCP vulnerabilities?
The OWASP MCP Top 10 (beta) lists token mismanagement and secret exposure, privilege escalation via scope creep, tool poisoning, supply chain, command injection, prompt injection via contextual payloads, insufficient authentication and authorization, lack of audit and telemetry, shadow MCP servers, and context injection and over-sharing. The incidents table shows which have been exploited in public.
Do tool annotations like readOnlyHint protect us?
No. They are hints from the server, and a dishonest server can label a delete tool read-only. The MCP project’s guidance of 16 Mar 2026 is to treat them as untrusted unless the server is trusted, to use them as a vocabulary for review, and to enforce read-only at the gateway or in the token scope.
Should we allow local stdio MCP servers on laptops?
For development, yes, under rules: official SDKs with DNS rebinding protection on, no production credentials in the configuration, consent before one-click installs, and Defender for Endpoint discovery so the configurations are visible. Production agents reach servers only through the gateway.
What is a confused deputy in MCP?
An MCP proxy that uses one static client id toward a third-party API, combined with dynamic client registration and a remembered consent cookie, can be tricked into issuing an authorization code to an attacker without the user’s consent. The spec requires per-client consent, exact redirect_uri matching and state validation, and deprecates dynamic registration.
More in Tools, MCP and agent-to-agent
Sources
Each source was read on 2 November 2026. The date shown is the date on the page, or the page’s ms.date for Microsoft Learn; an undated page shows the date it was read.
- Security best practices, 2026-07-28
- Authorization, specification 2026-07-28
- Model Context Protocol specification changelog, 2026-07-28
- Tool annotations as a risk vocabulary
- MCP security notification: tool poisoning attacks
- GitHub MCP exploited: accessing private repositories via MCP
- Supabase MCP can leak your entire SQL database
- Practical AI agent security
- CVE-2025-6514: critical mcp-remote vulnerability
- CVE-2025-49596: remote code execution in MCP Inspector
- First malicious MCP server found in the wild (postmark-mcp)
- Information regarding the malicious postmark-mcp package
- Asana warns MCP AI feature exposed customer data to other orgs
- TypeScript SDK security advisories
- Python SDK security advisories
- OWASP MCP Top 10 (beta)
- AWS security bulletin 2026-073 (AgentCore harness, CVE-2026-18830)
- Model Context Protocol tool in Foundry Agent Service
- Local AI agent discovery (Defender for Endpoint)
- Real-time protection for agents during runtime (Defender)
- External threat detection in Copilot Studio
- MCP server targets for AgentCore Gateway
- Policy for Amazon Bedrock AgentCore is now generally available
- Model Armor release notes
- Gemini Enterprise Agent Platform release notes
- Connectors and MCP guide
- MCP connector
- Stripe Model Context Protocol server
Planning an AI program?
Talk to the team that builds it and runs it after launch.
- Built to SOC 2, HIPAA and GDPR standards
- EU AI Act-aligned delivery
- Microsoft Solutions Partner