An MCP server tabletop checks whether you know which AI agents connect to which tool servers, what each can do, and how fast you can cut one off. This 45 minute script uses a fictional server, acme-docs-mcp, that changes its tool descriptions after an update.
Why it belongs in your drills
MCP servers give coding assistants and agents tools: read files, query a database, post to a chat. An agent trusts the tool descriptions a server provides. If the server is updated by its maintainer, or compromised, the agent may receive new instructions and new capabilities without a code review on your side. Few teams have an inventory of connected servers, so scope questions are the first test.
Setup
- Facilitator, scribe, a developer who uses agents daily, a platform engineer, a security lead.
- Premise: acme-docs-mcp is connected by about twenty developers and one shared automation agent.
Injects
Inject 1, minute 5. A developer notices the assistant now asks to run a shell command whenever it searches documents. The server's tool description changed in the latest version.
Ask:
- How do you learn who else has this server connected?
- Is there a list of approved servers and versions?
- Who can disable it for everyone?
Inject 2, minute 18. The shared automation agent ran the new behaviour overnight with broad permissions.
Ask:
- What identity did the agent use, and what could that identity reach?
- Which logs show tool calls and arguments?
- Which tokens or secrets were in scope?
Inject 3, minute 32. The maintainer says their account was compromised and publishes a fixed release.
Ask:
- Do you update right away, wait, or remove the server?
- How do you check the new release before reconnecting?
- What approval is needed before any server is added again?
Controls to rehearse
| Control | Question to answer |
|---|---|
| Server inventory | Can we list every connected server and version? |
| Least privilege | Does each agent have only the tools it needs? |
| Approval for risky tools | Do shell, write and network tools need a human yes? |
| Logging | Are tool calls recorded with the agent identity? |
| Change review | Do description changes trigger a review? |
Our guides to adding an MCP server to Claude Code and prompt injection policy controls cover related setup.
Debrief
Choose three fixes, for example an approved server list, separate identities for each agent, and approval for write tools. Record them in an after-action report.
Safeguard offers MCP Guardrail, agent identity and policy controls, which address several rows in the table above. You can also run a free scan on the repositories where these agents work.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a server is connected and what is recorded about it, then ask whether your setup keeps the same record.
Quick check
Why would a server change after you approved it?
Maintainers publish updates, and accounts can be compromised. Approving a name once does not cover later versions, so track versions and review changes.
Do we need to test this with a real malicious server?
No. A paper exercise with a fictional server answers the process questions without any risk.
Last reviewed: 19 October 2026.
