The Model Context Protocol lets AI agents call external tools and read data through a standard interface. That convenience raises practical questions: which servers an agent may connect to, what each tool may do, and whose credentials it acts with. MCP security covers these questions. Commonly discussed risks include tool poisoning, where a tool description carries hidden instructions for the model, prompt injection through content a tool returns, tools granted broader permissions than a task needs, and unvetted third-party servers.
Typical controls include an allowlist of approved servers, least-privilege scopes for each tool, user approval before sensitive actions, and a log of every tool call. For remote servers, the MCP specification defines an authorization flow based on OAuth 2.1. For example, a team might let an agent read a shared drive but require a person to confirm before the agent sends email. Agents also act on whatever data a tool returns, so teams check that this data is current and fit for the task.