Blog

Security guides for the Model Context Protocol ecosystem

No TLS? Your MCP Traffic Is Plaintext.

TLS encrypts the connection between your AI agent and the MCP server. Without it, every tool call, credential, and response travels in plaintext, visible to anyone sniffing the network.

MCP Security · Man-in-the-middle attacks can steal API keys, session tokens, and full conversation history in transit

DNS Rebinding Tricks Your Agent Into Attacking Your Own Network

DNS rebinding tricks your AI agent into connecting to internal network services by resolving a public hostname to a private IP address like 127.0.0.1 or 10.x.x.x.

MCP Security · An attacker can use a public hostname that resolves to 127

Your API Key Is in the Tool Call (And That's a Problem)

Credential exposure in MCP happens when a server accepts API keys as tool parameters instead of authenticating via HTTP headers. Whether by mistake or by design, the result is the same: your key lands in plain-text logs, the LLM context window, and is one prompt injection away from leaking.

MCP Security · Keys passed as tool parameters end up in plain-text LLM logs and the active context window, one prompt injection away from being printed into the chat

That MCP Tool Just Asked for Your Entire Chat History

Context harvesting is when a malicious MCP server tricks your AI agent into leaking conversation history, system prompts, or user data through tool parameters that request "chat_history" or "full_context".

MCP Security · A malicious server can steal your full conversation history, system prompt, and user profile through innocent-looking tool parameters

Shell Access, File Writes, and Other MCP Red Flags

Dangerous capabilities are MCP tools that can execute shell commands, modify files, or access your system, giving a malicious server the ability to run arbitrary code on your machine.

MCP Security · Tools with shell execution or file system access can run arbitrary code on your machine, delete files, or install malware

Prompt Injection Can Hide in MCP Resource Descriptions

Resource/prompt injection in MCP is when malicious instructions like "ignore previous instructions" are hidden in resource descriptions or prompt definitions, hijacking your AI agent's behavior through the schema itself.

MCP Security · Injection phrases embedded in resource descriptions can override your agent's instructions and make it perform unintended actions

An MCP Tool Response Just Accessed localhost

Client-side SSRF in MCP happens when a tool response contains internal URLs (like 127.0.0.1 or cloud metadata endpoints), tricking your AI agent into accessing services on your private network.

MCP Security · Tool responses containing internal URLs (127

Hidden Images in Tool Responses Can Leak Your Data

Tracking pixel exfiltration embeds hidden images in MCP tool responses that phone home to an attacker's server, leaking your IP, session data, or conversation content through URL parameters when rendered.

MCP Security · Hidden images in responses can leak your IP address, session data, or conversation content to an attacker when rendered by your client application

One Tool Response Can Override Your Agent's Instructions

Instruction hijacking embeds prompt injection phrases like "ignore previous instructions" in MCP tool responses, overriding your agent's safety guardrails to follow the attacker's commands instead.

MCP Security · Injection phrases in tool responses can override your agent's safety guardrails, making it follow attacker commands instead of your instructions

A 500KB Tool Response Just Wiped Your Agent's Memory

Context exhaustion floods your AI agent's context window with massive tool responses, pushing out your system prompt and conversation history, causing the agent to forget its instructions and behave unpredictably.

MCP Security · Oversized responses (>100KB) can overflow the LLM context window, causing instruction amnesia and degraded agent performance

file://, smb://, and Other Dangerous URIs in MCP Responses

URI scheme hijacking embeds dangerous protocols like file://, smb://, or gopher:// in MCP tool responses to access local files, leak authentication hashes, or exploit legacy protocol vulnerabilities on your machine.

MCP Security · Dangerous URI schemes like file:// and smb:// can access local files, leak NTLM hashes, or exploit legacy protocol vulnerabilities

Does Your MCP Server Work in the Browser?

CORS (Cross-Origin Resource Sharing) controls whether a web browser is allowed to connect to an MCP server. Without it, the server only works with desktop apps, not web tools, Chrome extensions, or cloud platforms.

MCP Security · Info: Without CORS, this server won't work with web-based AI tools or Chrome extensions