Is MCP secure?

MCP is as secure as the way you build and use it. The specification says so itself: the protocol can't enforce its own security rules, so the people building on it have to. With limited access, read-only where possible, logging and a person who confirms actions, you make the risks a lot smaller. It never gets to zero risk.

Why this matters

An MCP server gives an AI model access to your systems. The model can call tools and gets data back. The specification literally calls tools arbitrary code execution, and asks you to treat them with care. What MCP is, exactly, is in MCP: how to connect AI to the software you already use.

The real risks

Access that's too broad

The easiest option is a server that can reach everything, with the whole database behind it. That's also the most dangerous one. If something goes wrong, the damage is as big as the access. MCP's security guidance warns about this too. A key with broad rights that leaks gives access to everything that key is allowed to do.

Unclear permissions

On whose behalf does the server work? If it runs on one admin account, every user sees through the AI whatever that account sees. A colleague who normally only sees their own customers can suddenly ask for everyone's figures. The guidance also forbids a server from accepting and passing on keys that weren't issued for that server.

Prompt injection through data

An AI model reads what a tool returns. If that contains an instruction, the model may follow it. Think of an email, a product description or a customer comment with a hidden command in it.

Security firm Invariant Labs showed in May 2025 that this really happens. Someone placed an issue with hidden instructions in a public GitHub repository. An AI agent using the GitHub MCP server read that issue. It then pulled data from a private repository and put it in a public pull request. According to the researchers, the flaw wasn't in the server's code. It went wrong at the level of the agent: in one session it could read untrusted text, reach private data and publish something.

Credentials

An MCP server needs keys to reach your system. If they sit in a config file on a laptop, or end up in text the model reads, they can leak.

Other people's servers

An MCP server you install locally runs with the same rights as your AI application. According to the guidance, a malicious server can therefore run arbitrary code. So only install servers when you know who makes them and what they do.

What you do about it

Only give access to what's needed. A handful of tools that do exactly what was agreed. Only the fields the AI needs. And keys with as few rights as possible.

Work with the user's own permissions. For each person, the server only sees what that person is allowed to see in your system.

Start read-only. Read tools change nothing. If something goes wrong, nothing breaks. Write tools come later, and only where they really add something.

Have a person confirm actions. According to the specification, there should always be someone who can refuse a call. Definitely do that for actions that change data. And don't switch on an "always allow" button lightly, because then nobody is watching anymore.

Log every call. Then you see for each call which tool it was and who used it. If something odd goes on, you can trace what happened.

Keep secrets out of the model. Keys and passwords stay on the server. They never end up in a prompt or in what a tool returns. The server also checks every input before it does anything with it.

Watch for dangerous combinations. Does the AI read untrusted text, can it reach private data and can it write something outward? Then you have the situation from the GitHub example. Remove one of the three, or put a confirmation in between.

What this means if you have an MCP server built

Ask about these points. Which tools will there be, and with which rights? And where do the keys live? A good builder has an answer. How we set up an MCP server is on MCP server development.

Want to know where the risks are for your system? Message Adem.

Frequently asked questions

Can an AI read my whole database through MCP?

Only if the server allows it. Through MCP, an AI can't do anything the server doesn't offer as a tool. If you build the server to answer only a few fixed questions, the rest of your database stays closed.

What is prompt injection in MCP?

An instruction hidden in the data the AI reads. In an email or a customer comment, for example. The model may follow that instruction as if you gave it. Limited access and a confirmation step for actions make the damage a lot smaller.

Can I just install an MCP server from the internet?

Better not. A local MCP server runs with the same rights as your AI application, so it can run code on your computer. Only install servers from a maker you trust, and check what they're allowed to do.

Does my data go to the AI provider through MCP?

Whatever a tool returns ends up with the AI model. So that data goes to the provider of that model. Only send the fields that are needed, and check where your provider processes the data.