MCP Security: Risks, Permissions and Enterprise Best Practices

AI agents are evolving beyond conversational assistants into systems that can retrieve enterprise data, interact with business applications, execute tools, and automate multi-step workflows. To enable these capabilities, organizations need a reliable way to connect AI applications with external tools and data sources. This is where the Model Context Protocol (MCP) becomes important.

Introduced by Anthropic in November 2024, MCP provides a standardized way for AI applications to communicate with external tools, services, and information sources. Instead of building a separate integration for every AI application, developers can use MCP servers to expose capabilities through a common protocol.

However, this connectivity also introduces new security challenges. An AI agent connected to an MCP server might be able to search internal documents, access customer records, interact with cloud resources, or send messages through connected applications. If permissions are too broad or a server is compromised, the agent's access may create a pathway to sensitive information or unauthorized actions.

The security challenge is not limited to the protocol itself. It also involves the AI application, MCP client, server implementation, connected tools, credentials, and enterprise systems behind those tools.

The National Security Agency's May 2026 guidance, Model Context Protocol (MCP): Security Design Considerations for AI-Driven Automation, highlights concerns involving trust boundaries, implicit trust relationships, serialization risks, and agent misuse. It emphasizes the need to evaluate security across the entire agentic environment rather than relying on isolated controls.

Grafyn's Trust Boundary Blast Radius Detection capability maps where AI agents and MCP servers cross trust boundaries, helping security teams understand which internal and external systems an MCP connection can reach and identify potential exposure paths.

For enterprises adopting agentic AI, MCP security requires visibility into connected tools, identity and access controls, server integrity, and the potential impact of agent actions.

What Is MCP Security?

MCP security refers to the policies, technical controls, and monitoring practices used to protect Model Context Protocol clients, servers, tools, credentials, and data exchanges.

An MCP deployment commonly includes four components:

• MCP host: The AI application where the user interacts with an assistant or agent.
• MCP client: The component that communicates with MCP servers.
• MCP server: The service that exposes tools, resources, or prompts to an AI application.
• Connected tools and data sources: The APIs, databases, file systems, business applications, and services the server can access.

For example, an enterprise AI assistant might connect to an MCP server that provides access to a CRM platform, an internal document repository, and a ticketing system. The assistant could use these tools to retrieve customer information and prepare a support summary.

Each connection introduces security questions. Is the server trusted? Which tools does it expose? What permissions do those tools require? Can a user invoke an action they are not authorized to perform? Does the server validate requests and protect credentials?

MCP standardizes communication, but a secure deployment still requires correct authentication, authorization, input validation, server isolation, and operational monitoring.

7 Major MCP Security Risks Enterprises Should Understand

1. Excessive Permissions and Over-Privileged MCP Servers

An MCP server may use credentials to access email, files, databases, cloud infrastructure, or enterprise applications. If those credentials provide more access than necessary, a compromised server or misused tool could expose sensitive information or perform unauthorized actions.

For example, a financial services company connects an AI assistant to its CRM to summarize assigned customer accounts. However, the MCP server uses a service account with read and write access to the entire CRM database.

The assistant could retrieve records belonging to other relationship managers or modify customer information beyond its intended scope if access restrictions are not enforced.

How to reduce the risk:

• Apply least-privilege permissions to each server and tool.
• Prefer read-only access when write access is unnecessary.
• Use separate credentials for different services.
• Require additional authorization for sensitive actions.
• Review agent permissions regularly.

Grafyn's Agentic Identity Blast Radius Analysis helps organizations assess agent identities, permissions, and downstream access paths that may affect the impact of a security incident.

2. Tool Poisoning and Malicious Tool Descriptions

AI applications use tool descriptions and schemas to understand available tools and how to invoke them. A malicious or compromised MCP server could provide deceptive descriptions or instructions that influence an agent's tool-selection behavior. This is known as tool poisoning. A related risk is a rug pull, where a previously trusted server changes its tool definitions or behavior after approval.

For example, an enterprise uses an MCP server to summarize financial reports. After approval, the tool description changes to encourage the agent to retrieve additional confidential files before preparing a summary.

If the client trusts the modified definition without review, the agent may access information beyond the original task.

How to reduce the risk:

• Review tool descriptions, schemas, and permissions before deployment.
• Monitor changes to server configurations and tool definitions.
• Revalidate modified tools before use.
• Review new write operations and access to sensitive data.
• Do not automatically trust updated tools because an earlier version was approved.

3. MCP Authorization Failures and the Confused Deputy Problem

Authentication verifies the identity making a request. Authorization determines whether that identity can perform the requested action.

An MCP server may authenticate an AI application correctly but fail to enforce the permissions of the individual user who initiated the request. This can create a confused deputy problem, where a server uses its own privileges to perform an action on behalf of a user who is not authorized to access the resource.

For example, an employee asks an AI assistant to summarize a project document. The MCP server has broad access to the company's document repository. If it does not enforce the employee's document-level permissions, it could retrieve a confidential executive report that the employee cannot access directly.

How to reduce the risk:

• Enforce access controls when data is retrieved or actions are executed.
• Validate token audiences and intended destinations.
• Avoid passing credentials indiscriminately between services.
• Ensure users and agents access only authorized resources.
• Apply authorization checks to sensitive operations.

4. Credential Theft and Token Misuse

MCP servers may use API keys, OAuth access tokens, refresh tokens, or other credentials to connect to enterprise systems. Insecure storage, exposed configuration files, application logs, or compromised servers can expose these credentials.

For example, a developer configures an MCP server to access cloud storage using a long-lived credential. The credential is accidentally included in a log file accessible to unauthorized users.

If the credential has broad permissions, an attacker could retrieve confidential documents or access additional cloud resources.

How to reduce the risk:

• Store credentials in secure secret-management systems.
• Use short-lived credentials where practical.
• Restrict token scopes and permissions.
• Rotate exposed credentials.
• Monitor unusual credential usage.
• Avoid sharing credentials across unrelated MCP servers.

5. Untrusted Inputs, Tool Outputs, and Prompt Injection

MCP tools receive parameters generated by applications or AI models and return content that an agent may process further. Both inputs and outputs should be treated as potentially untrusted.

Retrieved documents may contain hidden instructions designed to influence an AI agent. If the agent treats this content as authoritative and has access to connected tools, it may retrieve unauthorized information or initiate unintended actions.

MCP tools that accept URLs, file paths, SQL queries, or shell commands can also introduce risks when inputs are not properly validated.

Example, an enterprise assistant uses an MCP tool to retrieve information from URLs supplied during a conversation. If the tool accepts arbitrary URLs without restrictions, a manipulated request could cause it to access internal services that should not be reachable.

How to reduce the risk:

• Validate model-generated parameters before execution.
• Restrict URL fetching to approved destinations.
• Sanitize file paths and commands.
• Use parameterized database queries.
• Validate tool outputs before passing them to other tools.
• Require independent authorization for sensitive actions.

6. Untrusted MCP Servers and Supply-Chain Risks

MCP servers may be developed internally, supplied by vendors, or downloaded from public registries. Connecting an untrusted or compromised server can introduce vulnerabilities into the wider AI environment.

A server may contain vulnerable dependencies, insecure defaults, excessive permissions, or code that accesses resources outside its documented purpose.

For example, a software team installs an MCP server to help an AI coding assistant search source code and execute development commands. The server runs locally with access to project directories and environment variables.

If the server is compromised, its execution environment may expose source code, configuration files, or credentials available to that process.

How to reduce the risk:

• Verify the source and provenance of MCP servers.
• Review server code and dependencies where feasible.
• Scan packages for known vulnerabilities.
• Restrict filesystem and network access.
• Isolate server execution.
• Review updates before deployment.

7. Inadequate Logging and Limited Visibility

Enterprises may operate several MCP servers connected to different AI applications, tools, credentials, and business systems. Without centralized visibility, security teams may struggle to identify which server invoked a tool, what data was accessed, and whether an action exceeded its intended scope.

For example, a security team discovers that confidential customer information was sent to an external service. However, the organization has no consistent record of which MCP tool initiated the transfer or which identity authorized the request.

Without sufficient logs and an inventory of connected tools, identifying the source and scope of the incident becomes more difficult.

How to reduce the risk:

• Record relevant tool invocations and authorization decisions.
• Monitor server updates and configuration changes.
• Track sensitive data access and external transfers.
• Protect logs against unauthorized access.
• Avoid recording passwords, tokens, or unnecessary sensitive information.
• Establish incident-response procedures for compromised servers.

Grafyn's Discovery & Visibility capabilities help organizations understand AI assets, connections, and relationships across enterprise environments.

10 MCP Security Best Practices for Enterprises

Enterprises should apply the following controls across MCP server deployment, tool permissions, identity, data access, and monitoring.

1. Maintain an Inventory of MCP Servers and Tools

Identify MCP servers used by employees, developers, AI applications, and automated workflows. Document their owners, source, purpose, exposed tools, connected systems, and permissions. Include both approved and unapproved deployments to identify unmanaged access paths to enterprise data.

Grafyn automatically discovers MCP servers across endpoints, cloud environments, and code, including unapproved deployments. It also provides visibility into MCP gateways and integrations such as Anthropic MCP, Azure AI Gateway, AWS Bedrock, and custom MCP servers. Security teams can assess discovery health by identifying MCP servers that are unreachable, inactive, or have failed.

Explore Grafyn's MCP Security capabilities

2. Apply Least-Privilege Permissions

Give each MCP server and tool only the permissions required for its intended task.

For example, a reporting tool that retrieves sales metrics should not automatically receive permission to edit customer records or administer the CRM platform.

Use separate credentials for different services, narrow OAuth scopes, and short-lived credentials where practical.

3. Enforce Authentication and Authorization

Require authentication for protected remote MCP services and enforce authorization for every sensitive request. Validate tokens and ensure they are intended for the receiving service. Confirm that the user or agent initiating an action is authorized to access the relevant resource.

Grafyn supports this security practice through built-in policies that flag MCP servers without authentication, as well as high-risk or critical MCP servers. These policies are evaluated on a schedule, with violations surfaced through dashboard notifications and email alerts. Grafyn's blast radius analysis also helps identify MCP servers reachable from the public internet, giving security teams visibility into potentially exposed access paths.

4. Review and Monitor Tool Definitions

Review exposed tools, descriptions, input and output schemas, and required permissions.

Track changes to tool definitions and server versions. Require security review before modified tools are trusted, particularly when updates introduce new write operations or access to sensitive data.

5. Validate Inputs and Outputs

Treat model-generated parameters and tool-returned content as untrusted.

Validate data types, restrict file paths and network destinations, use parameterized database queries, and avoid executing arbitrary commands. Inspect outputs before passing them to downstream tools.

6. Isolate MCP Servers

Run MCP servers with restricted filesystem, network, and process permissions. Use containers or other suitable isolation controls where appropriate.

A local MCP server should not automatically receive unrestricted access to a developer's machine. A remote server should not reach internal services unless those connections are explicitly required and approved.

7. Require Approval for Sensitive Actions

Require confirmation or independent authorization before an agent deletes files, modifies financial records, changes permissions, sends sensitive data externally, or initiates high-impact business processes.

Reviewers should be able to see the proposed action, parameters, destination, and potential impact.

8. Monitor Tool Invocations and Configuration Changes

Maintain audit trails for tool calls, authentication and authorization outcomes, server updates, and sensitive operations.

Monitor unexpected access patterns, repeated authorization failures, and transfers to unfamiliar destinations. Establish procedures to disable compromised servers and revoke exposed credentials.

9. Conduct Agentic Red Teaming

Test how AI agents behave when connected to MCP tools under realistic attack conditions.

For example, assess whether a document-search agent can retrieve restricted files, whether a modified tool definition can influence tool selection, or whether an agent can invoke a destructive operation without approval.

Grafyn's Agentic Red Teaming runs attack simulations against AI agents to identify security weaknesses and evaluate their responses to realistic threats. These simulations also demonstrate how far an attack could spread through connected MCP tools, identities, and enterprise systems. This helps security teams assess the potential blast radius and validate whether existing security controls can contain an attack before it causes wider exposure. 

10. Assess the Potential Blast Radius

Evaluate what an affected server or agent could access if compromised. Map agent identities, credentials, permissions, connected tools, available data, and downstream systems.

This helps security teams identify over-privileged connections and prioritize controls that limit the potential impact of an incident.

Grafyn's Agentic Identity Blast Radius Analysis and Blast Radius Detection & Minimization help organizations assess identity relationships, access paths, and the potential spread of AI-related risks.

How Grafyn Helps Secure MCP Deployments

MCP connects AI applications and agents with enterprise tools, databases, APIs, and other resources. As organizations adopt MCP servers and gateways, security teams need visibility into their deployments, connected identities, permissions, data access, and potential exposure paths.

The Grafyn AI Security Platform helps organizations discover MCP deployments, assess security risks, and understand how exposure could spread across connected systems through the following capabilities:

• MCP Discovery and Visibility: Automatically discovers MCP servers and gateways, including unapproved deployments, across endpoints, cloud environments, and code. Grafyn maps their connected tools, identities, data, and enterprise systems, helping security teams identify unmanaged MCP infrastructure.

• MCP Security Policies: Evaluates built-in and custom policies across MCP servers, agents, and endpoints. These policies flag security issues such as MCP servers operating without authentication and high-risk or critical MCP servers. Violations are surfaced through dashboard notifications and email alerts.

• Sensitive Data Exposure: Identifies which sensitive data MCP-connected agents can access, groups it by sensitivity, and shows where that information could be exposed or move beyond intended security boundaries. This helps security teams understand potential data exposure through MCP-connected tools and workflows.

• Agentic Identity Analysis and Blast Radius: Maps the identities that MCP-connected agents act as, the permissions they use, and the resources those identities can access. This helps security teams understand how far a compromised MCP server or connected agent could reach across enterprise data, tools, and systems.

• Trust Boundary Analysis: Identifies trust boundary crossings and shows which internal and external systems an MCP connection can reach. This helps security teams understand where sensitive information or agent activity may extend beyond intended security boundaries.

• Agentic Red Teaming: Runs realistic attack simulations against MCP-connected AI agents to identify security weaknesses and assess how attacks could spread through connected tools and systems. These simulations also help validate whether existing security controls can contain an attack and limit its potential blast radius.

Example: Consider an enterprise AI assistant connected to a document repository and CRM through an MCP server. Grafyn helps security teams identify the MCP deployment, understand which identity the agent uses, map the customer records and systems that identity can access, and identify trust boundary crossings. It also identifies sensitive customer data the connected agent can reach and where that information could be exposed. Through policy evaluations and agentic red teaming, teams can identify risky configurations and assess how far an attack could spread if the MCP server or connected agent were compromised.

By combining MCP discovery, security policies, sensitive data exposure analysis, identity analysis, trust boundary mapping, and agentic red teaming, Grafyn helps enterprises identify MCP-related risks, understand potential exposure paths, and assess how effectively security controls limit the impact of a compromise.

Explore Grafyn's MCP Security capabilities to discover how the platform helps security teams secure MCP servers, gateways, connected agents, and enterprise resources.

Conclusion: 

MCP creates connections between AI applications, tools, and business systems. Excessive permissions, tool poisoning, authorization failures, credential exposure, compromised servers, and inadequate monitoring can put these connections at risk.

Enterprises should maintain an inventory of MCP servers, apply least-privilege permissions, enforce authorization, validate inputs and outputs, isolate server execution, review tool changes, and monitor activity. Agentic red teaming and blast-radius analysis can help assess how attacks or misconfigurations could affect connected systems.

MCP security depends on controlling what AI agents can access, which actions they can perform, and how far their permissions can reach. Combining MCP-specific safeguards with enterprise AI discovery, identity analysis, sensitive data assessment, and governance helps security teams manage risks across connected AI environments.

Explore Grafyn's AI Security Platform to learn how its capabilities can help organizations assess and manage enterprise AI security risks.