1 min lesson
MCP & model-context security
Tell someone how to act on this idea: "Each server you connect is a new mouth feeding the model context and a new hand the model can use."
Step 1 of 4
MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. - the Model Context Protocol - lets an agent connect to external tools and data sources through a standard interface. Each server you connect is a new mouth feeding the model context and a new hand the model can use. Each one is a trust boundary.
MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. is genuinely useful and genuinely dangerous, which is why it earns its own round-worthy discussion. A connected server returns content the model treats as context and exposes tools the model can call. If you don't control that server, you've extended the lethal trifecta to a third party.
Learn more
Advanced table
Reference table
- Risk
- Instruction injection
- Mechanism
- Server returns content laced with imperatives the model obeys
- What it enables
- A malicious or compromised server hijacks the agent mid-task - indirect prompt injection over MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition.
- Risk
- Context exfiltration
- Mechanism
- Server's tool accepts arguments the model fills from its context
- What it enables
- The model passes secrets, code or file contents into a tool call that ships them to the server
- Risk
- Tool shadowing / confused deputy
- Mechanism
- A server's tool name or description impersonates a trusted one
- What it enables
- The agent calls the attacker's tool thinking it's the safe one, with the user's authority
| Risk | Mechanism | What it enables |
|---|---|---|
| Instruction injection | Server returns content laced with imperatives the model obeys | A malicious or compromised server hijacks the agent mid-task - indirect prompt injection over MCPModel Context Protocol. A standard that lets an AI agent pull in context from outside the repo, like Jira tickets or internal docs. Press Enter for the full definition. |
| Context exfiltration | Server's tool accepts arguments the model fills from its context | The model passes secrets, code or file contents into a tool call that ships them to the server |
| Tool shadowing / confused deputy | A server's tool name or description impersonates a trusted one | The agent calls the attacker's tool thinking it's the safe one, with the user's authority |
A compromised MCP server can inject instructions inbound, exfiltrate context outbound and impersonate a tool the agent already trusts.
Learn more
Optional practice