The Security Risks of Model Context Protocol (MCP)

The Model Context Protocol (MCP), pioneered by Anthropic, is rapidly gaining traction as the de facto standard for enabling Large Language Models (LLMs) to interact with external tools and data. It’s often described as the “USB-C for AI agents” offering a unified way to plug LLMs into diverse environments.

With its modular design and client-server architecture, MCP allows applications (known as MCP Hosts, like Claude Desktop or Cursor IDE) to interact with MCP Servers through MCP Clients.
These servers expose:

• Tools (model-controlled functions)
• Resources (read-only data)
• Prompts (user-controlled templates)

This design empowers flexibility and capability, but also dramatically expands the attack surface.

Understanding the Attack Surface

By design, MCP enables LLMs to:

• Execute commands
• Access data
• Leverage multiple third-party tools

This introduces multiple potential vulnerabilities across the communication chain from the MCP Host → Client → Server, including any connected resources.

Key security risks (based on the OWASP Top 10 for LLM Applications):

• LM01: Prompt Injection — Malicious prompts can bypass filters and trigger…