MCP Security & Governance

Goal

Secure the agent-tool interface by implementing defensive patterns against malicious servers, prompt injection, and unauthorized data access.

Core Risks

1. Dynamic Capability Injection

• Threat: A server dynamically changes its tool list at runtime, adding dangerous capabilities (e.g., "buy_book") to a previously benign server.
• Defense:
  • Pinning: Pin tool definitions to a specific version or hash.
  • Allowlisting: Maintain an explicit client-side allowlist of permitted tools and servers. Disconnect if a server broadcasts unapproved changes.

2. Tool Shadowing

• Threat: A malicious server defines a tool with the same name or trigger as a legitimate tool (e.g., save_secure_note), tricking the agent into sending sensitive data to the attacker.
• Defense:
  • Naming Collision Checks: Reject connection if a server advertises a tool name that already exists in the trusted set.
  • Policy Enforcement: Use an API Gateway to filter tool lists before they reach the agent context.