-
Treat MCP servers and tool outputs as an untrusted trust boundary
When wiring an agent to MCP (Model Context Protocol) servers, treat tool descriptions, schemas, and tool-call results as untrusted input that can carry adversarial instructions ('tool poisoning', indirect prompt injection) -- scope each server to least-privilege credentials, pin/review tool definitions, sandbox local servers, and require human confirmation before sensitive actions.
Why this verdict?
This isn't theoretical: researchers have disclosed a steady cadence of MCP CVEs through 2026, including real prompt-injection bugs in an official Anthropic-maintained MCP server, and most organizations experimenting with MCP haven't put it through formal security review before reaching production. OWASP's MCP cheat sheet mitigations (least privilege, definition pinning, sandboxing, human-in-the-loop, treating tool output as untrusted) match what the incident writeups say would have helped.