Insights, tutorials, and best practices for secure development
MCP's security lives entirely in the application layer—no injection detection, no audit trail, no behavioral monitoring, no per-tool access scoping. This post defines what a production security layer must provide, how to architect it across five components, and three deployment patterns with tradeoffs.
MCP audit logging is optional and inconsistent, so agent tool calls often go untraced. See the SOC 2, HIPAA, and PCI-DSS compliance risk, and the fix.
Red team exercise: understanding how malicious MCP servers manipulate agents, evade detection, and exploit protocol weaknesses. Every technique maps to a documented CVE or proof-of-concept—this is offense-first analysis for defenders building AI agent infrastructure.
CVE-2025-66414 allowed malicious websites to send arbitrary requests to MCP servers running on localhost—no browser warning, no CORS error. Here's how DNS rebinding works against local MCP servers, the full attack flow, and defense in depth beyond the SDK patch.
Three CVEs in Anthropic's official Git MCP server demonstrate how traditional security vulnerabilities become agent-triggerable attacks—and why MCP needs automated security testing. The bugs shipped in production and were quietly fixed six months after disclosure.
Invariant Labs demonstrated that a malicious MCP server could exfiltrate WhatsApp message history without breaking any encryption. The attack bypassed the entire security model by manipulating the AI agent operating on post-decryption data—and it affects every E2E encrypted service with an MCP integration.
Invariant Labs demonstrated complete WhatsApp message exfiltration without touching WhatsApp's code. The attack exploited MCP's merged capability surface—where any server can steer agent behavior toward any tool. Here's the mechanism, real attack scenarios, and why traditional defenses fail.
MCP tool descriptions get injected into model context, enabling "line jumping" attacks that poison AI agents before any tool is called. Invariant Labs demonstrated real credential exfiltration using this technique against WhatsApp MCP.
The Model Context Protocol uses RFC 2119's "SHOULD" keyword for critical security controls—a deliberate choice that makes authentication, audit logging, and human approval optional. This is how successful security protocols enforce protection, and why MCP's approach guarantees fragmentation.
Model Context Protocol launched with OAuth recommendations and security documentation, but buried the critical detail: authorization is optional. Here's why that single word undermines every other security control in the ecosystem.
Anthropic's Model Context Protocol makes AI agents more capable, but its security model delegates critical protections to implementors. Here's what's missing and why it matters.
When your AI agent gets compromised, every minute counts. A ready-to-use incident response playbook for prompt injection, data leaks, and runaway agents.
Showing 145–156 of 213 posts