1 min lesson
MCP & model-context security
Say what this means in practice. "The Model Context Protocol, MCP, lets an agent connect to external tools and data sources through a standard interface."
Step 1 of 3
The Model Context Protocol, MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition., lets an agent connect to external tools and data sources through a standard interface. Each server you connect is a new mouth feeding the model context and a new hand the model can use. Each one is a trust boundary.
MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. is genuinely useful and genuinely dangerous, which is why it earns its own round-worthy discussion. A connected server returns content the model treats as context and exposes tools the model can call. If you don't control that server, you've extended the lethal trifecta to a third party.
Learn more
Advanced table
Three risks from one connection
Three risks from one connectioningress instructions, egress data, impersonation
- Risk
- Instruction injection
- Mechanism
- Server returns content laced with imperatives the model obeys
- What it enables
- A malicious or compromised server hijacks the agent mid-task: indirect prompt injection over MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition.
- Risk
- Context exfiltration
- Mechanism
- Server's tool accepts arguments the model fills from its context
- What it enables
- The model passes secrets, code or file contents into a tool call that ships them to the server
- Risk
- Tool shadowing / confused deputy
- Mechanism
- A server's tool name or description impersonates a trusted one
- What it enables
- The agent calls the attacker's tool thinking it's the safe one, with the user's authority
| Risk | Mechanism | What it enables |
|---|---|---|
| Instruction injection | Server returns content laced with imperatives the model obeys | A malicious or compromised server hijacks the agent mid-task: indirect prompt injection over MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. |
| Context exfiltration | Server's tool accepts arguments the model fills from its context | The model passes secrets, code or file contents into a tool call that ships them to the server |
| Tool shadowing / confused deputy | A server's tool name or description impersonates a trusted one | The agent calls the attacker's tool thinking it's the safe one, with the user's authority |
A compromised MCP server can inject instructions inbound, exfiltrate context outbound and impersonate a tool the agent already trusts.
Learn more
Optional practice