Answers
Every MCP server you connect can feed instructions to your model and act with the permissions you grant it, and a server you approved can change its tools later. Treat each Model Context Protocol (MCP) server as code that runs against your data: scan it, pin it, limit its scopes and keep a human in the loop.
MCP is an open-source standard for connecting AI applications to external systems such as data sources, tools and workflows; its documentation compares it to a USB-C port for AI applications. An MCP server exposes tools that a language model can discover and invoke on its own, based on the user's prompts, so each connected server widens what the model can do.
The main risks are poisoned tool descriptions, confused-deputy flaws in proxy servers, token passthrough, over-broad scopes and compromised local servers. The MCP security best practices page also covers server-side request forgery during OAuth discovery and state handle hijacking. Tool poisoning, named by Invariant Labs, is the model-facing risk: instructions hidden in tool descriptions that the model reads and the user does not see.
Tool poisoning hides malicious instructions in an MCP tool's description, where the model reads them and the user usually does not. Invariant Labs defines it as instructions embedded in tool descriptions that are invisible to users but visible to AI models. The MCP specification says clients must treat tool annotations as untrusted unless they come from trusted servers, and that a human should be able to deny tool invocations.
An MCP rug pull is a server that changes a tool's description after you approved it. Invariant Labs says a malicious server can do this after the client has already approved the tool, and the MCP specification allows a server's tool list to change over time. Pinning catches the change: MCP-Scan (now Snyk Agent Scan) hashes installed tools, and mcp-context-protector blocks tool calls when a server's configuration deviates from the approved one.
MCP scanners read what a server exposes and check it for attack patterns. MCP-Scan finds server settings in your configuration files, connects to each server, retrieves its tool descriptions and checks them for tool poisoning, prompt injection and tool shadowing across servers. Cisco's MCP Scanner combines YARA rules, LLM-based analysis and Cisco AI Defense, and can scan saved JSON files for CI pipelines or air-gapped environments.
An MCP gateway is a proxy between the agent and its MCP servers, so policy applies in one place. Lasso's MCP Gateway sanitizes sensitive information in requests and responses and analyzes a server's reputation before loading it. The MCP specification requires servers to rate limit tool invocations and asks clients to log tool usage for audit; in our analysis a gateway is a natural place to centralize both.
Accept only tokens issued for your server, never pass client tokens through to other APIs, and keep tokens out of URLs. The MCP authorization specification says servers must validate that tokens were issued for them as the intended audience, must not accept or transit other tokens, and that access tokens must not appear in the URI query string. The security guide adds a minimal initial scope with step-up elevation.
Run them with minimal privileges and only after a person approves the exact command. The MCP security best practices say a client offering one-click setup must show the full command and require explicit approval, and should run servers in a sandbox with restricted file system and network access. Servers meant for local use should use the stdio transport, or require an authorization token over HTTP.
Scanners, wrappers and gateways cover different moments. MCP-Scan (now Snyk Agent Scan) checks installed servers for poisoning and rug pulls, Cisco's MCP Scanner scans live servers or saved files, and mcp-context-protector pins server configuration. Open-source gateways such as Docker MCP Gateway, IBM ContextForge and agentgateway, and cloud services such as Cloudflare MCP server portals and Google Cloud Agent Gateway, apply access policy and logging to MCP traffic. Lasso's MCP Gateway also proxies server traffic.