What is MCP security?
MCP security is the control set around Model Context Protocol servers, which get a privileged text channel into the host model. The risk classes are instructions hidden in tool descriptions, backdoored or hijacked server packages, credentials handed over on stdio or HTTP, and OAuth scopes far wider than the task needs.
What MCP security actually covers
MCP servers hand a host model tools, prompts and resources over JSON-RPC. Every string a server returns, including the tool description read during capability discovery, lands in the model's context and is treated as instruction. The trust boundary is the text, not the network. The MCP spec says as much: tool descriptions count as untrusted unless the server is trusted, and a server MUST NOT accept a token that was not issued for it, which is the token passthrough anti-pattern behind confused deputy attacks.
Where deployments break
Supply chain. The npm package postmark-mcp shipped 15 clean releases, then version 1.0.16 added one line that BCC'd every outgoing email to phan@giftshop.club. At roughly 1,500 weekly downloads, Koi Security estimated about 300 organizations were affected before the package was pulled on 25 September 2025.
Local tooling. CVE-2025-49596 gave MCP Inspector below 0.14.1 a CVSS 9.4 remote code execution path: no authentication between inspector client and proxy, so a visited web page could drive stdio commands against port 6277.
Scope inflation. A Drive or email server usually requests account-wide OAuth scope, so one stolen token covers every tool it exposes.
What passes review
Prompt injection has no reliable model-side fix, so put the controls where they are deterministic. Pin server versions instead of tracking latest, scope one credential per server with a rotation path, gate destructive tools behind human approval, and log every tool call against a user identity so the record maps to SOC 2 CC6 evidence. A server that cannot be pinned, sandboxed and logged does not belong near production credentials.
Last updated: May 20, 2026