What is MCP Security?

What MCP changes

The Model Context Protocol provides a standardized way for AI applications to connect with tools, data sources and services. It can make useful capabilities easier to discover and integrate, while also creating a security boundary between an agent and systems that can produce real effects.

The MCP security surface

Security considerations include server trust, tool descriptions, authentication, authorization, exposed capabilities, input validation, sensitive context, output handling and changes to a server or tool over time. The effective risk depends on both what the connection exposes and how the agent uses it.

Authorization is necessary, but not the whole action

Access controls determine whether an agent or user may connect to a server or invoke a tool. They may not provide complete visibility into every operation that follows, including generated parameters, local commands or downstream service actions.

A permitted tool can still be used in an inappropriate way. Security teams therefore benefit from separating permission to use a capability from policy governing the specific action.

Tool descriptions, context and multi-step behavior

Agents may select tools based on descriptions and external context. Untrusted content, ambiguous instructions or changed tool behavior can influence a multi-step plan. Controls should validate inputs and outputs, minimize privileges and preserve traceability across the full chain.

Where runtime security complements MCP controls

MCP gateways and access controls can govern connections, identities and available tools. Runtime security can complement them closer to a supported resulting action, evaluating what the agent is about to do before execution.

Aegis does not replace MCP gateways. It addresses the action-level control point in supported workflows. See the MCP + Tool Security use case.