MCP Security Digest — April 2025

MCP Security is a top concern for anyone building Agentic AI systems. The Model Context Protocol (MCP) connects tools, agents, and actions. It plays a role similar to TCP/IP—but for autonomous workflows. If MCP is compromised, the entire agent stack is at risk. Attackers can inject prompts, hijack tools, and reroute agent behavior.

In this digest, we explain why MCP Security matters now—and how to defend against the growing wave of real-world threats.

New Videos on MCP Security

Model Context Protocol (MCP): The Key To Agentic AI This video introduces the Model Context Protocol (MCP) and explains why it’s gaining traction in the AI world. It breaks down each part of the acronym—Model, Context, and Protocol—and shows how MCP connects clients and servers in autonomous agent systems. The speaker walks through how to try out MCP, build a basic MCP server, and understand the available transport formats. There’s also a comparison of MCP with existing API standards. The video ends with key takeaways and suggestions for those interested in using MCP in real-world projects.

I gave Claude root access to my server… Model Context Protocol explained

This tutorial dives into Anthropic’s Model Context Protocol (MCP) by showing how to build a TypeScript-based MCP server. The server gives Claude (an AI model) access to external context and the ability to perform actions—essentially extending its capabilities beyond pure text generation. The video explores how MCP allows the model to request tools, modify data, and interact with a live environment. By the end, viewers understand how MCP bridges LLMs and real-world systems, highlighting both its potential and its security implications.

Research & Surveys

AI Model Context Protocol (MCP) and Security This article provides a technical overview of the Model Context Protocol (MCP) and how it connects AI models to tools, APIs, and data sources. It shows how MCP’s host-client-server architecture supports security enforcement, Zero Trust, and authenticated interactions. Key risks—like unmonitored access, missing approval flows, and privilege sprawl—are clearly explained. The piece includes practical examples and ends with best practices for secure MCP use in agentic and RAG systems.

Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions

This article offers a comprehensive overview of the Model Context Protocol (MCP) as a standardized interface for connecting AI models to external tools and data sources. It breaks down MCP’s core architecture and server lifecycle—covering creation, operation, and update phases. The authors analyze security and privacy risks at each stage and suggest mitigation strategies. The paper also reviews current adoption trends, use cases, and supporting tools, while outlining future challenges and opportunities. It concludes with actionable recommendations for ensuring MCP’s secure and scalable integration in the evolving AI ecosystem.

MCP Security: Updates, Standards, and Best Practices

Official MCP Server & Tools Specification This MCP Specifications Update outlines how servers expose tools that language models can invoke to interact with external systems—such as APIs, databases, or computational services. Each tool has a unique name and metadata describing its schema, enabling structured, dynamic interactions. The update emphasizes that tools are designed to be model-controlled, allowing LLMs to discover and use them contextually based on user prompts. However, the protocol remains flexible, allowing different implementations to define their own user interaction models. This ensures MCP can adapt to diverse use cases while maintaining interoperability. OAuth in MCP: A Messy Update

This article critically examines the new MCP Authorization specification, introduced to bring OAuth 2.1-based access control to Model Context Protocol servers. While the update aims to improve MCP security, it introduces significant challenges for enterprise adoption—such as increased complexity, poor alignment with existing OAuth setups, and confusion around server roles. The spec currently treats each MCP server as both a resource and authorization server, which conflicts with common enterprise best practices. The author outlines these friction points and highlights ongoing discussions to revise the spec. The piece also includes actionable advice for securing MCP servers in the meantime.

How to Secure MCP Systems

This article from Block’s InfoSec team shares practical lessons from securing Model Context Protocol (MCP)deployments in real-world agent workflows. The authors explain how MCP enables agents to interact deterministically with tools like GitHub, Jira, or Snowflake through custom MCP servers. They clarify common misconceptions about MCP servers and offer a mental model for securing both communication channels: between the agent and the MCP server, and between the server and the target tool. The piece outlines concrete best practices for securing connectivity, identity, and the host environment. It’s a valuable guide for teams operationalizing MCP in production systems.

Subscribe for updates

Stay up to date with what is happening! Get a first look at news, noteworthy research and worst attacks on AI delivered right in your inbox.