MCP, the Model Context Protocol, is an open standard that lets an AI application connect to external tools and data through small servers. It is safe to use when you treat each server as code with access to your systems: verify its source, limit what it can reach, and require consent for risky actions.
What does MCP actually do?
The MCP documentation describes a client-server design. An MCP host, which is an AI application such as a coding assistant or desktop chat app, creates one MCP client for each MCP server it connects to. Each client keeps a dedicated connection with its server. Messages use JSON-RPC.
A server offers capabilities, such as tools the model can call, data it can read, and prompt templates. The protocol only standardizes how context is exchanged. It does not decide how the AI uses a model or what it is allowed to do. That part is up to you.
What is the difference between local and remote servers?
The specification defines two standard transports. With stdio, the client launches the server as a subprocess and talks over standard input and output. With Streamable HTTP, the server runs as an independent service that can serve many clients.
Local servers usually serve one client. Remote servers serve many, and need real authentication.
What can go wrong?
The MCP project publishes its own security best practices, and they read like a short list of design flaws to avoid:
- Confused deputy: an MCP proxy server that fronts a third-party API with a static client ID can be tricked into handing out authorization codes without proper user consent.
- Token passthrough: a server accepts a token without checking it was issued to that server, then forwards it downstream. The guidance calls this an anti-pattern and ties it to the audience claim in the token.
- Local server compromise: a malicious startup command in a client configuration, a malicious payload inside a server package, or an insecure server left on localhost and reached through DNS rebinding.
For Streamable HTTP, the specification says servers must validate the Origin header to prevent DNS rebinding, should bind to localhost when running locally, and should authenticate all connections.
A constructed example
A developer adds a "database helper" server to their editor after finding it in a forum post. The setup command runs a package through npx. Nobody reads the package. It starts with the developer's permissions, so it can read the SSH keys and cloud credentials in the home folder. The MCP guidance describes exactly this shape of risk. The fix is not to ban MCP. It is to pin the package version, read what it does, run it with the least access that works, and approve each tool the model can call.
Who is responsible for what?
The protocol sets how a host and server talk, so the pieces you control are the host application settings, the servers you install and the credentials they hold. Three questions help assign ownership: who approves a new server, who watches what it does, and who removes it when it is no longer needed. In most teams the honest answer today is nobody, which is why an inventory is the first item on the checklist below.
How to check or apply this
- Keep an inventory of every MCP server in use, who installed it, and what it can reach.
- Install servers from sources you can verify, and pin versions.
- Run local servers with a restricted user, or inside a container with only the folders they need.
- For remote servers, require authentication, and validate that tokens were issued for that server.
- Keep read tools and write tools separate, and ask for consent before write actions.
- Log tool calls, with their arguments, so you can reconstruct what an agent did.
- Review client configuration files in code review, since they can contain startup commands.
Safeguard runs an MCP server at mcp.safeguard.sh, with unlimited tool calls on every plan, and an MCP Guardrail that applies policy to what agents are allowed to call.
Quick check
Is MCP a security product?
No. It is a communication standard. Security depends on how servers are built, installed and permissioned.
Does MCP make prompt injection worse?
It widens the surface, because tool results and fetched content can carry attacker text into a model that can also act. Separate read and write rights and keep a human approval step.
Sources
- Model Context Protocol, Architecture overview
- Model Context Protocol, Security Best Practices
- Model Context Protocol specification, Transports
Last reviewed: 18 October 2026.
