Model Context Protocol

Why it comes up

In this site’s reading, it comes up when a team connects an agentic workflow to its own systems and a security reviewer asks what the agent can touch. “Open protocol” can sound like a safety claim. It is not one.

A 2026 sheet from the US National Security Agency (NSA) says MCP’s security posture “remains uneven and highly dependent on implementation discipline rather than protocol guarantees”. The sheet cites the November 2025 revision of the specification.

What to do about it

The model picks which tool to call, and text it reads can steer that choice. That is prompt injection. The MCP project’s security policy says a report that an LLM invoked an unexpected tool is not an MCP vulnerability. So the limits go in the host and the servers, as guardrails in code.

Give each server only the access its task needs. That is least privilege. The NSA sheet recommends that tool execution be constrained and sandboxed.

I start every new tool read-only. Any action that writes, spends money or touches personal data needs approval from a named person. Credentials live with the gateway or the server, never in the prompt, and they rotate every quarter.

Before a third-party server connects

I pin the exact version of a third-party server and review its source before it connects. The approved-server list lives in the client’s AI register.

Where the specification stops

The specification, in its 28 July 2026 revision, names who should do the first three jobs. The protocol does not check that anyone does.

• Approval before a tool runs: the host. There should always be a human in the loop who can deny a call.
• Checks on inputs and access: each server. Servers must validate all tool inputs and implement proper access controls.
• Logs: the host’s clients. They should log tool usage, which feeds observability. MCP traffic goes through the gateway. The call and the result are logged, never the full arguments, and the log is kept for 90 days. The log is reviewed in the weekly ops check.
• Local servers: a local server the client starts runs with the client’s privileges. The policy says the SDK’s STDIO transport, which does the starting, “is not a sandbox”. Local STDIO servers run inside a container by default. Remote HTTP is used only through the gateway, with authentication.

What the client receives

The server inventory and the approved-server list land in the client’s AI register. This work is part of the two-week AI readiness and risk assessment.

When I review this entry

Last reviewed: 7 October 2026.

I review this entry again on every new revision of the specification and on any new class of CVE.