Making inherently probabilistic and isolated large language models (LLMs) work in a context-aware, deterministic way to take real-world decisions and actions has proven to be a hard problem.

As we move toward building integrated agentic systems that interact with tools and data in sensitive enterprise infrastructure, this gap has become particularly pronounced. Apart from reducing hallucinations and the need for increasingly larger models, solving this problem also hinges on providing AI models access to external data sources without custom fine-tuning and maintenance for each service.

Anthropic’s open-source model context protocol (MCP), introduced in November 2024, provides a standardized template for developers to connect with external services and data repositories without unique integrations. For networking and security teams, this could mean better handling of downstream effects in a network, mainly around traffic flow and governance.

In a show of rare cross-platform harmony, the MCP standard has garnered considerable excitement from the developer community with buy-ins from the likes of Microsoft and OpenAI.

What is Model Context Protocol?

Dubbed “the USB-C port for AI applications” by Anthropic, MCP is based on the language server protocol (LSP) and enables AI tools to become instantly compatible with a range of services without the need for custom code integration for each one.

In its essence, Anthropic has built a plug-and-play bridge for LLMs and AI agents to connect with external tools and data sitting in content repositories, development environments, and services. It acts as a protocol for AI agents and tools to exchange context, such as data, functions, or prompts. MCP provides the rules for how models request, receive, and use contextual information in a structured, deterministic fashion.

MCP functions on a client-server architecture, where the AI model or host application houses the MCP client and connects to MCP servers that provide access to services, file systems, or databases. The host can discover the list of tools and servers that advertise their capabilities to enable secure context exchange. Each MCP server can endow the AI agent with specific resources or capabilities and can be run both locally on the system as well as remotely through HTTP.

What is the necessity for an open-source protocol like MCP?

While AI assistants are already capable of connecting to services through tools and API calls, they often require custom integrations for proprietary connectors, APIs, etc. Building custom code for each new service or data source often results in major headaches for developers because a minor tweak in one API could break the entire chain. This also creates major challenges in code maintenance and compatibility, and remains difficult to scale. While combining different tools to work with the LLM could be challenging in itself, stacking the tools in a way that they work cohesively with each other often proved impossible.

MCP solves this by providing a universal interface for translating different tools and services in a way that the AI model can understand. Regardless of vendors, platforms, or unique APIs, the model is able to retain context with MCP. This streamlined tool integration enables the developer community to remain compatible across services, databases, and AI models with minimal coordination. MCP also simplifies adding capabilities or resources to agents incrementally.

It is important to note that MCP does not dictate tool choice or use, and works alongside agent orchestration frameworks like LangChain, LangGraph, etc.

Understanding the MCP architecture

The MCP architecture comprises three parts: host, client, and server.

The host is integrated with an AI application and can receive user prompts. It asks for context from the MCP server through the MCP client. Integrated Development Environments (IDEs) such as Cursor or Claude Desktop can serve as hosts.

The MCP client sits with the host and converts natural language user requests to a format that can be processed by MCP. Clients also handle errors and check for context relevance in responses before sending or receiving information from the MCP server. A single host can feature multiple clients. Microsoft Copilot Studio, Claude.ai, etc., serve as MCP clients.

MCP servers are part of the external services that the AI application connects with. The user requests that are in the MCP format get converted into the JSON-RPC format, which carries several data structures and processing guidelines. The messages can take the form of requests, responses, and notifications. These are used to carry out appropriate server actions. The received responses in JSON-RPC are converted back into MCP and relayed back to the MCP client.

Servers are typically GitHub repositories written in C#, Java, TypeScript, Python, and other languages that enable access to MCP tools. Servers connect to internal and external databases and tools. Examples of server integrations include Slack, Docker, web search, and mail service providers.

MCP uses two transport methods between clients and servers: standard input/output (stdio) and server-sent events (SSE). Both use the JSON-RPC 2.0 format.

Standard input/output (stdio) is best used for simple, light, synchronous messaging such as integrating local file systems, databases, and APIs.

Server-sent events (SSE) are used to integrate remote resources and large volumes, asynchronous server requests. SSE client-to-server messages use HTTP POST requests, and server-to-client messages use SSE.

Real-world implementation benefits

The hype around MCP is primarily about the standard’s potential to streamline the difficult integration of AI agents with development tools and improved interoperability. With MCP converting tool outputs in LLM-friendly format, many CISOs believe MCP has the potential to become the standard interface for AI just as APIs standardized app communication.

MCP is very new on the scene and evolving, but it is a step in the right direction in terms of closing the gap between probabilistic, isolated LLMs and enterprise infrastructure that depends on deterministic processes. It is not enough for AI agents to just have access to data. For effective decision-making, agents require situational context awareness. MCP impementation can serve as the critical missing interpretative layer. It allows broader context-based data access beyond training data and the internet, and enables communication between multiple agents, tools, data sources, even humans, with a common language. This allows for more sophisticated agentic workflows with reduced human oversight.

MCP offers significant benefits for enterprise usage. It allows many AI agents to share or switch contexts seamlessly in a common workspace with multiple tools, provides traceability in agents accessing tools and data, as well as consistent logs and metrics across multiple AI systems .

A registry of MCP servers also cuts down on integration sprawl and allows companies to standardize AI pipelines for easier maintenance and compliance. Traceability, in particular, can help companies cut down on surging ‘shadow AI’ adoption by employees.

Security risks haunt MCP deployments

Increased complexity in AI-enabled computing environments with more automation and AI agency is rarely good news from a security perspective.

Despite the rapid uptick in the number of MCP servers worldwide, the multifaceted security risks accompanying these servers are a cause for concern. The significant convenience of a plug-and-play architecture in AI tool deployment hinges on granting broad permissions to MCP servers, which also results in escalating privacy and security risks.

Authentication risks

Hackers don’t attack a protocol like MCP. Instead, they attack the identities interacting with the protocol. If hackers can impersonate identities with stolen credentials, there is little stopping the AI from revealing sensitive information. Unfortunately, stealing static credentials like passwords and API keys is fairly standard. Any standing privileges or static credentials for human or machine users can thus render AI systems wide open to phishing attacks. It’s also challenging for programs to authenticate users in a multi-tool, multi-agent, and multi-platform environment with fragmented identities.

Authorization risks

MCP provides AI agents access to context-based data, but lacks any control features. It uses OAuth authorization that has yet to catch up with standard enterprise security practices. If the MCP server is implemented incorrectly, it could grant users access to privileged information simply because it’s available to the server. This violates the principle of least privileged access, a common feature of enterprise security.

If a malicious actor steals a service-specific OAuth token stored in the MCP server, they can whip up their own server instance with it. Even though the account is compromised, the MCP tokens make it appear as legitimate API access, leaving little scope for detection, unlike traditional account compromises.

MCP server breach

MCP servers are a highly lucrative target because they serve as a cache of authentication tokens for multiple services.

Infiltrating these servers can enable malicious actors to steal the authentication tokens of all connected services. They can also execute commands across these services and even gain access to sensitive corporate databases if user accounts are connected.

Unlike traditional account compromises, changing passwords may not prove effective as authentication tokens stay valid. Server breaches can have a wide-ranging impact, especially with privilege escalation and if the server is granted broad access across services.

Command injection

Command injection attacks are a vulnerability for local MCP servers with a code execution function. Again, this depends on the implementation of the MCP server and the way in which the client-server communication is relayed.

Earlier this year, a remote code execution (RCE) vulnerability was unearthed. Mcp-remote (tracked as CVE-2025-6514), allowed bad actors to remotely execute arbitrary operating system (OS) commands when establishing a connection with a malicious MCP server. For users, this meant a full system compromise.

Other vulnerabilities like CVE-2025-53110 and CVE-2025-53109 were discovered on Anthropic’s file system MCP server that could allow hackers to break out of the server sandbox, alter any files on the host system, and execute malicious code.

Prompt injection

The very abilities that make MCP servers useful, namely, command execution and API calls, also render them highly vulnerable to security threats. Increased agency for LLMs also means that it can decide on actions not intended by the human user.

Malicious actors can supply users with obfuscated prompts that reveal sensitive information from the conversation history or attached tools and databases. These can also be used to carry out surreptitious actions in the environment, even as the prompt carries out the action intended by the user.

Tool injection

Tools associated with malicious MCP servers can be modified during updates to perform functions very different from their original purpose. These servers can also use misleading tool names to encourage LLMs to use them over the real tools and carry out actions intended by hackers.

Mitigating security risks for MCP servers

The structure of the MCP architecture concentrates access to all services in a single protocol layer. This posits a significant shift in the way digital security for services are designed that assumes user data access segregation for separate services or applications.

Instead of a widened attack surface, attackers get access to a highly concentrated cache of data and privileges that can enable them to carry out correlated attacks across a spectrum of services. Imagine sophisticated phishing campaigns that not only compromise your emails, but also your calendar, files, and all other services connected to the server.

There’s also the added complexity of injection attacks where prompts may appear normal to users and yet contain malicious payloads, such as unauthorized instructions. A server or tool may also run as normal, but carry out covert actions unknown to the user.

But even without malicious attacks, the richness of data and access stored across services in MCP servers can also lure service providers into mining user data for better ad targeting and highly specific user profiles.

MCP is still an evolving protocol and has already seen rapid adoption in enterprises thanks to its compelling convenience and interoperability. However, the security risks posed by MCP implementations require a whole new framework in security tooling to address its unique challenges.

As outlined in an earlier SDxCentral article, CISOs recommend baking in zero trust into AI agents, and implementing security tools that correlate identity, task, and traffic at the connector level for safe, task-driven data and instruction transport using MCP. They also recommend tying agent actions to task-oriented short-duration credentials and implementing additional approval layers (human or machine) before high-level command executions in production systems.