AI security / Agent protocols
MCP security for agents with access.
Model Context Protocol expands what an AI agent can see and do. FailSafe tests the servers, tools, resources, permissions, and trust boundaries that turn a model into an operator.
Definition
MCP is a new trust boundary.
MCP security is the practice of securing Model Context Protocol servers, tools, resources, and the agent runtimes that connect language models to external data and actions.
The important question is not only whether the model follows its system prompt. It is whether untrusted data can influence a tool call, whether a server grants more access than intended, whether tool metadata has been poisoned, and whether a compromised resource can move across a tenant or network boundary.
FailSafe maps testing to the OWASP MCP Top 10 and related agent-security guidance where that helps teams communicate risk.
Testing checklist
How to test an MCP server
- 01Map servers, tools, resources, identities, and trust boundaries.
- 02Test direct and indirect prompt injection through tool descriptions and retrieved content.
- 03Probe permissions, secrets, tenant isolation, network access, and dangerous side effects.
- 04Deliver reproducible findings, remediation guidance, and continuous validation coverage.
Questions & answers
Frequently asked questions
A practical starting point for securing Model Context Protocol servers and agent tools.
MCP security is the practice of securing Model Context Protocol servers, tools, resources, and the agent runtimes that connect language models to external data and actions.
Testing can cover tool authorization, server trust boundaries, prompt injection through resources and tool descriptions, tool poisoning and shadowing, SSRF and unsafe fetch behavior, secret exposure, cross-tenant access, command execution, message integrity, logging, and output handling.
Start with an inventory of servers, tools, resources, identities, and data flows; define least-privilege actions; test untrusted content and malicious tool arguments; verify isolation, authentication, replay protection, and logging; then repeat the assessment as tools, dependencies, prompts, and permissions change.
An MCP server or dependency can change the tools, descriptions, resources, or behavior exposed to an agent. Security testing should verify server provenance, pin dependencies and tool definitions where possible, restrict network and filesystem access, and detect changes before production use.