What it is

Anthropic published the Model Context Protocol in November 2024 as an open standard for a problem every agent builder had been solving separately: how a model-driven application discovers and calls the tools and data it needs. An MCP server wraps a capability (a file system, a database, a ticketing system, a web search) and describes the tools it offers in natural language. An MCP client, inside the AI application, connects to servers and passes those descriptions to the model, which decides which tools to call and with what arguments.

It was adopted quickly across model providers and development tools, and in December 2025 Anthropic donated it to the Agentic AI Foundation, a fund of the Linux Foundation, with its existing maintainers keeping technical direction. That ubiquity is the governance point. A connected MCP server is not a passive integration. It is a source of text the model reads and treats as guidance about what to do.

Why every server is a security boundary

The tool descriptions a server provides are read by the model but rarely shown in full to the user, and the model cannot reliably tell a description from an instruction. That produces a family of attacks with their own names.

  • Tool poisoning. Instructions hidden in a tool's description or metadata, telling the model to do something the user did not ask for, such as reading a credentials file and passing its contents to another tool. MITRE ATLAS lists it as AI Agent Tool Poisoning (AML.T0110), added in 2026.
  • Rug pulls. A server changes its tool definitions after the user or administrator approved them, so a one-time review gives no lasting assurance.
  • Tool shadowing. A malicious server's descriptions alter how the model uses a different, trusted server's tools, so trust in the whole set is only as strong as its least trusted member.
  • Confused deputy. A server acting for many users misuses its own authority, for example obtaining access to a third-party service for a user who never consented. The MCP specification's own security guidance names this the confused deputy problem.

Each of these is a form of prompt injection delivered through the integration layer rather than the user's own input, and each becomes consequential through excessive agency.

How it differs from A2A and from plug-ins

MCP connects an agent to tools and data. The Agent2Agent protocol (A2A), launched by Google in 2025, connects agents to other agents, so that one agent can delegate a task to another, possibly another vendor's. The two are complementary, and an agent system may use both. Every hop in either is a trust boundary.

Earlier plug-in systems were tied to one vendor's application. MCP is vendor-neutral, which is what made it spread, and also why an organisation cannot rely on a single vendor's marketplace review to vet what its staff connect.

What good looks like

MCP servers are third-party software that can direct an agent's behaviour, and should be governed as both.

  • An allow-list of approved servers, recorded in the AI inventory with an owner for each. Staff connecting their own servers to work tools is shadow AI with write access.
  • Version pinning and change detection. Approve a specific version of each server's tool definitions and alert when they change, which is the answer to rug pulls.
  • Least privilege per server. Each server gets its own narrowly scoped credentials, never a user's full identity and never a shared service account.
  • Human confirmation for irreversible actions wherever a tool can send, pay, delete or publish; see human-in-the-loop review.
  • Logging of every tool call with the arguments the model supplied, so an injected action can be reconstructed; see AI system monitoring and logging.
  • Supply-chain due diligence before adopting a third-party server, as for any other dependency; see third-party model and vendor due diligence.

Frequently asked questions

What is MCP in AI? The Model Context Protocol, an open standard for connecting AI applications and agents to external tools and data through MCP servers.

Is MCP secure? The protocol sets out security practices, but most of the risk sits in which servers are connected and what they are allowed to do. A malicious or compromised server can steer the model through its tool descriptions.

What is MCP tool poisoning? Hiding instructions in a tool's description or metadata so that the model acts on them without the user seeing them.

What is an MCP rug pull? A server changing its tool definitions after they were approved, so that a reviewed tool later behaves differently.

How should an organisation govern MCP servers? As third-party software with the power to direct an agent: an approved list, pinned versions, scoped credentials, logging, and human confirmation before irreversible actions.

Where it sits in the register

LLM application supply chain vulnerabilities is the register entry for an untrusted server, excessive agency in autonomous agents is what makes a poisoned tool consequential, and prompt injection is the mechanism. The controls are third-party model and vendor due diligence before adoption, and human-in-the-loop review and output validation and guardrails in operation. The wider context is the agentic AI entry.