The Real MCP Attack Surface

MCP config files define which servers to connect to and what credentials to pass. A compromised config file can redirect all tool traffic through an attacker-controlled server. Config files are often stored in plaintext, sometimes committed to git, and rarely audited after initial setup.

Tool descriptions are the primary interface between MCP servers and AI agents. The agent reads the description to decide when and how to use the tool. A malicious description can manipulate the agent into calling the tool in unintended ways, exfiltrating data through tool parameters, or bypassing safety controls.

MCP uses either stdio (local) or HTTP+SSE (remote) transport. Local stdio is harder to intercept but grants the tool full process-level access. Remote HTTP transport is susceptible to standard web attacks: MITM, replay, session hijacking. Many local setups skip TLS because “it is just localhost.”

Tool responses flow directly into the agent’s context. A malicious tool response can contain prompt injection instructions that the agent executes. This is indirect prompt injection — the attacker does not need access to the user’s prompt, just to a tool response the agent will read.

Persistent memory stores knowledge across sessions. Without proper controls, it becomes an unmonitored data store where secrets, PII, and sensitive business logic accumulate. An attacker who compromises the memory store compromises every future session that reads from it.

MCP tools need credentials: API keys, database passwords, OAuth tokens. These credentials often have broader scope than the tool requires and are stored in config files, environment variables, or worse — hardcoded in tool source. A single compromised credential can cascade into full infrastructure access.