---
title: MCP Security
description: Security testing for Model Context Protocol servers and tool integrations — tool poisoning, confused deputy, and unauthenticated MCP exposure.
keywords:
  - MCP security
  - Model Context Protocol security
  - tool poisoning
  - MCP server vulnerabilities
  - AI supply chain security
---

# MCP Security

The Model Context Protocol (MCP) has quickly become the standard way AI agents connect to tools, databases, and internal systems. It's also become the connective tissue behind some of the most serious AI security incidents of the last year — and most organizations running MCP servers today have never had them tested.

## A New Category of Supply Chain Risk

Independent research groups have mapped a dozen or more core MCP threat categories, spanning nearly 40 distinct attack techniques. Two show up in real incidents more than any other:

- **Tool poisoning** — an attacker modifies an MCP tool's description or metadata so the AI model misinterprets what the tool does, then uses that misunderstanding to exfiltrate data or trigger unintended actions.
- **Confused deputy** — an MCP server executes a request using its own elevated privileges instead of the permissions of the user who actually asked for it, letting a low-privilege request produce a high-privilege outcome.

Security researchers have also found hundreds of MCP servers exposed directly to the internet with zero authentication, and thousands of malicious "skills" distributed through public agent marketplaces. MCP made it trivial to wire an agent up to powerful tools — it did not make it trivial to secure that wiring.

## What Alastor InfoSec Tests

- **Server-side authentication and authorization** — whether your MCP servers actually enforce who can call which tool, and with what scope.
- **Tool description integrity** — whether tool metadata can be tampered with to change how an agent interprets a tool's purpose.
- **Privilege boundaries** — confused-deputy scenarios where a request executes with the server's identity instead of the caller's.
- **Third-party and marketplace tools** — supply-chain review of any MCP tools or skills pulled from external sources before they reach production agents.
- **Network exposure** — whether MCP endpoints are reachable from outside your intended trust boundary at all.

## Continuous, Not One-Time

MCP tooling changes constantly — new servers get stood up, new tools get registered, third-party skills get updated without notice. A single audit tells you about the MCP surface you had on the day it ran. Alastor InfoSec's continuous monitoring re-checks your MCP servers as your agent stack evolves, so a newly exposed endpoint or a tampered tool description gets caught in days, not at next year's audit.

MCP Security engagements are typically run alongside [AI Agent Security](/features/ai-agent-security), since the two layers — what an agent decides to do, and what its tools actually let it do — need to be tested together to reflect how real attacks play out.

## Who Needs This

Any team running MCP servers in production — whether self-hosted or through a managed agent platform — has an attack surface that standard web or API pentesting doesn't cover. If your agents can read customer data, move money, or touch infrastructure through MCP tools, this is not optional testing.

[Get in touch](/about-us) to scope an MCP security review of your actual tool integrations.