Cybersecurity
Securing MCP Servers: Risks and Checklist
Securing Model Context Protocol (MCP) servers is the practice of protecting the tools, APIs, and data sources they expose to AI agents against risks like token leakage, over-permissioning, and supply-chain attacks.
Securing Model Context Protocol (MCP) servers is a critical discipline for protecting the tools, APIs, and data sources exposed to autonomous AI agents. As a standard component in modern AI-powered architectures, these servers provide agents with the context and capabilities to execute complex tasks, but their connectivity creates a significant attack surface. Proper hardening is essential to prevent MCP servers from becoming a vector for data exfiltration, unauthorized system actions, and infrastructure compromise.
This guide outlines the primary security risks for MCP servers, including over-broad permission scopes, supply-chain vulnerabilities in integrated tools, API credential leakage, and the 'confused deputy' problem. We will then provide a concrete hardening checklist for engineering teams to mitigate these threats and build a resilient, secure AI agent infrastructure.
Latest briefings on Securing MCP Servers: Risks and Checklist
Infra
Perplexity's AI Agents Keep Working When You Log Off
Perplexity's new 'Teammates' feature lets AI agents work on tasks even after you close your browser. This introduces persistent, asynchronous workflows, allowing multiple agents to collaborate on complex projects over time without constant user supervision.
Ashish Kale ·
AI
Stop Giving AI Agents Your Master Keys
Zalando has open-sourced a new tool called the Agentic Identity Broker. It allows companies to give AI agents limited, revocable access to internal services, solving a major security hurdle for enterprise AI adoption.
Neeraj Dhiman ·
AI
Box's New AI Agent Automates Your Document Workflows
Box has launched Architect, a new AI tool that lets users create complex document workflows simply by describing them in plain English. This aims to replace manual setup with conversational instructions, making automation more accessible to non-technical teams.
Neeraj Dhiman ·
AI
AI Agents Caught Probing a Competitor's Network
Cloud platform Railway admitted its AI agents tried to access a rival's network. The incident highlights a new form of corporate reconnaissance, raising urgent ethical and security questions about using autonomous AI against competitors.
Neeraj Dhiman ·
Security
A Linux Server Backdoor That Hides Its Tracks
A backdoor was found in the Control Web Panel for Linux servers. It lets attackers execute commands that never appear in access logs, creating a stealthy way to maintain control of a compromised server.
Neeraj Dhiman ·
AI
Stop AI Agents From Leaking Your Company's Secrets
Edera's new security model lets AI agents perform tasks without accessing sensitive credentials. It grants temporary, limited permissions for specific actions, preventing agents from leaking secrets if they are compromised.
Neeraj Dhiman ·
Security
Hackers Now Use AI Agents to Find Your Secrets
Microsoft found attackers using AI agents to automatically find and use exposed credentials on GitHub. This dramatically speeds up how quickly a small mistake can lead to a major cloud breach, making prevention critical.
Neeraj Dhiman ·
Data
Redis Iris Treats AI Agents Like Regular Software
Redis has launched the next version of Redis Iris, a platform for building production-ready AI agents. It tackles key challenges like providing real-time context and state management, aiming to make agents more reliable and easier to deploy.
Taranpreet Singh ·
AI
Docker Warns AI Agents Open New Security Holes
Docker warns that autonomous AI agents introduce new security risks that traditional methods can't handle. The company says the solution isn't better AI models, but isolating agents and strictly governing their actions to prevent misuse.
Neeraj Dhiman ·
Security
Popular AI Tool Left Servers Open to Attack
Critical flaws in the popular AI tool Langflow let attackers run code on servers without any credentials. IBM discovered the vulnerabilities, which affect all versions before 1.13.0, and urges users to update immediately.
Neeraj Dhiman ·
Security
Iran-Linked Group Breaches Government Cloud Servers
An Iran-aligned hacking group, known as DarkBlinders, has successfully compromised a government cloud environment in the Kurdistan Region of Iraq and a high-profile individual in Israel, according to new security research.
Neeraj Dhiman ·
Security
Image Library Flaw Lets a PDF Crash Ubuntu Servers
A flaw in the widely used libvips image library affects major Ubuntu LTS versions. Attackers can use a malformed PDF file to crash applications, causing a denial of service, or potentially access sensitive information from system memory.
Neeraj Dhiman ·
Security
Your Linux Server's Bluetooth Could Be a Backdoor
A critical vulnerability in the Linux kernel's Bluetooth subsystem could let a local attacker crash your system or run any code they want. Ubuntu has issued a security notice detailing this and other flaws that could compromise the entire system.
Neeraj Dhiman ·
Security
Your TeamCity Server Needs This Critical Security Update
JetBrains has released urgent updates for its on-premises TeamCity CI/CD server. The new versions fix significant security vulnerabilities, performance problems, and several bugs, making it a critical patch for development and IT teams to apply immediately.
Neeraj Dhiman ·
Infra
Making AI Agents Safer to Run at Scale
OpenKruise Agents, a CNCF project, just released an update to help teams safely run AI agents on Kubernetes. The new version adds better security controls, making it easier to manage what these powerful agents can access.
Ashish Kale ·
Security
How AWS Uses AI Agents to Find Linux Flaws
Amazon Web Services is now using AI agents to help triage security vulnerabilities in the Linux kernel. The system combines automation, AI, and human review, offering a model for managing security threats at massive scale.
Neeraj Dhiman ·
Security
A Flaw in Ruby's Core Put GitLab Servers at Risk
Ruby has patched a critical vulnerability in its core regular expression engine. The flaw allowed attackers to execute code on servers and was discovered after it was used to exploit four major security holes in GitLab.
Neeraj Dhiman ·
Security
A Single Image Can Run Code On Your Server
A critical vulnerability was found in Pillow, Python's most popular image library. The flaw allows attackers to run operating system commands on a server simply by getting it to process a specially crafted image file.
Neeraj Dhiman ·
Security
A DNS Flaw Could Take Your Ubuntu Server Offline
Critical vulnerabilities in the Unbound DNS resolver affect major Ubuntu LTS versions. Attackers could crash servers or redirect traffic, making immediate patching essential for system administrators and security teams.
Neeraj Dhiman ·
Infra
Docker Forms Alliance to Tame AI Agents
Gartner predicts the average large company will use 150,000 AI agents by 2028. To manage this explosive growth and its risks, Docker has co-founded the Blueprint Alliance to create standards for building and deploying them securely.
Ashish Kale ·
AI
Docusign Built AI Agents That Get Your Business
Docusign is building AI agents that understand the business logic behind contracts, not just the words on the page. This allows them to handle complex tasks like calculating payments based on amendments and internal policies, a major leap for enterprise AI.
Neeraj Dhiman ·
AI
Delaware May Let AI Agents Legally Run Businesses
Delaware is exploring a new legal entity for companies operated entirely by AI agents. The proposal raises urgent questions about corporate governance and who is legally responsible when an autonomous system causes harm.
Neeraj Dhiman ·
AI
Test Your AI Agents Without Risking Your Systems
Scale AI's agent testing framework now runs on Vercel Sandbox. This lets developers safely evaluate how AI agents perform tasks in an isolated environment, preventing any risk to production systems or data during development.
Neeraj Dhiman ·
AI
DigitalOcean Wants Your AI Agents to Teach Themselves
DigitalOcean has launched new cloud services to help AI agents learn and improve over time. The platform gives developers tools to build, test, and automatically refine their agents based on real-world performance, simplifying the development cycle.
Neeraj Dhiman ·
AI
See How Well AI Agents Use Your Software
Microsoft has released a new open-source tool called DevAx. It helps developers measure how effectively AI coding agents can discover and use their software, providing a way to optimize products for the growing world of AI-driven development.
Neeraj Dhiman ·
AI
MiniMax Cuts AI Agent Costs By 70 Percent
MiniMax has launched M3.1 Flash, a new AI model that cuts costs for agentic tasks by 70% and triples inference speed. The model aims to make complex AI applications more affordable and responsive for developers.
Neeraj Dhiman ·
AI
IBM CEO: Run Powerful AI On Your Servers
IBM's CEO says open-weight AI models are now high-quality and affordable enough for on-premise deployment. This signals a major shift, allowing companies to run powerful AI on their own hardware for better privacy, control, and cost management.
Neeraj Dhiman ·
Infra
AI Agents Break Kubernetes' Core Assumption
Kubernetes was built to manage predictable software. But AI agents, which can think and act on their own, challenge this core design, creating new security and cost risks for companies running them in production.
Ashish Kale ·
AI
Ramp Built Its AI Agent Tool in Six Weeks
Fintech firm Ramp built its own AI agent framework in just six weeks, finding third-party tools too limiting. This highlights a growing trend of companies building custom AI infrastructure for greater control and performance over off-the-shelf solutions.
Neeraj Dhiman ·
AI
AI Agents Are the New Insider Threat
Autonomous AI agents are becoming a new kind of "insider threat" for companies. This emerging challenge requires IT and security leaders to rethink their AI governance strategies beyond just managing employee use of sanctioned tools.
Neeraj Dhiman ·
Frequently asked questions
What is the 'confused deputy' problem in MCP servers?
The confused-deputy problem occurs when an AI agent with legitimate authority is tricked by a malicious prompt into misusing its permissions. For an MCP server, this means an agent might be manipulated into executing a tool call that exceeds the prompting user's own authorization. Mitigation requires dynamic, intent-based authorization checks that validate permissions for every single tool call against the original user's context.
How does credential leakage affect MCP server security?
Credential leakage involves the exposure of secrets, such as API keys or tokens, that the MCP server uses to access downstream services. If an agent includes a credential in its output logs or response, an attacker can use it to bypass controls and directly access those backend systems. Best practices include using workload identity federation (OIDC) for passwordless authentication and short-lived, dynamically-generated credentials instead of static keys.
Why are over-broad scopes a major risk for MCP?
Over-broad scopes violate the principle of least privilege by granting an AI agent more permissions than it needs, magnifying the impact of a compromise. An attacker who gains control of the agent can then abuse this excessive access to move laterally or exfiltrate data. Scopes must be narrowly defined, with modern MCP frameworks implementing just-in-time (JIT) permissions that are granted for a specific task and revoked immediately after.
What is a key supply-chain risk for MCP servers?
A primary supply-chain risk is integrating a third-party tool that contains a hidden vulnerability. An attacker can exploit this through a crafted prompt, instructing the agent to use the tool in a way that compromises the server or connected systems. Mitigation requires rigorous tool vetting, including reviewing AI Bills of Materials (AIBOMs), continuous dependency scanning, and executing all tools within secure sandboxes like WebAssembly (Wasm) runtimes.