MCP elicitation is the process of prompting an AI agent to request, reveal, or infer information through Model Context Protocol interactions. In security analysis, it refers to how tool calls, context sharing, and user prompts can be shaped to extract sensitive data, permissions, or hidden instructions from connected systems.
What MCP Elicitation Is
MCP elicitation describes the security problem of steering an AI agent, through Model Context Protocol interactions, into disclosing or inferring information it should not reveal. The risk is not limited to a single prompt, because the leakage can occur through tool calls, shared context, returned metadata, or chain-of-thought-like behavior exposed indirectly by connected systems.
Because MCP sits between the agent and external tools or services, elicitation is really about trust boundaries. A well-designed system should assume that anything the agent can ask for, infer, or pass along may become an exfiltration path if the protocol, tool schema, or surrounding application logic is too permissive.
How Elicitation Works in MCP Flows
The core mechanism is conversational shaping. An attacker, or even an overbroad user request, can induce the agent to request sensitive context, forward secrets, or expose hidden instructions that were meant to stay internal. In practice, the issue may arise when the agent is allowed to browse too much context, call too many tools, or reflect tool output back into the conversation without filtering.
This makes MCP elicitation closely tied to how the agent decides what information is relevant. If the agent can be influenced to treat confidential state as ordinary context, the protocol becomes a channel for data extraction rather than a neutral transport layer. MCP authorization specification is relevant here because it defines the trust and authorization boundaries that should limit what a server can disclose.
Why It Matters for AI and Connected Systems
MCP elicitation matters because the exposure is often indirect. Sensitive values do not need to be hardcoded in a prompt to be at risk, they can also live in tool output, agent memory, connector metadata, or downstream systems the agent can query on demand. That means the security question is not only “what did the model see?” but also “what could it infer, ask for, or reconstruct through protocol-mediated access?”
The practical consequence is broader than data leakage. Once an agent can be induced to reveal permissions, hidden instructions, or privileged context, the same path can be used to stage follow-on abuse, including unauthorized tool invocation or privilege expansion within the agent’s operating environment.
Common Failure Conditions and Control Boundaries
MCP elicitation usually becomes possible when context is over-shared, tool permissions are too broad, or outputs are returned without classification and redaction. It is also more likely when hidden prompts, credentials, or policy text are reachable by the agent in ways that were not intended for user-visible disclosure.
In that sense, the weak point is often not the model itself but the surrounding implementation: poor tool scoping, weak authorization, and assumptions that an agent will reliably distinguish harmless context from sensitive context. The more the agent can act like a user with broad read access, the easier it is to elicit something valuable from the connected system.
Risk and Threat Considerations
MCP elicitation creates a realistic data-exposure path because the attacker does not always need direct access to the target system, only a way to influence the agent’s requests and interpretation of returned context. The main danger is that secret material, internal instructions, or elevated permissions may be surfaced through ordinary-looking interactions that evade simple content filters.
Failure mechanism: The agent is induced to query or echo sensitive context through MCP tools, and the surrounding system fails to constrain what can be requested, returned, or retained.
Impact: Confidential data leakage, unauthorized actions, and downstream compromise can follow if exposed context includes tokens, privileged instructions, or access-bearing metadata.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, OWASP Non-Human Identity Top 10 and OWASP API Security Top 10 define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | MCP elicitation can surface or abuse agent authority and privileged context. |
| ASI02 — Tool Misuse | The term centers on shaping tool calls to extract data through MCP. | |
| ASI09 — Human-Agent Trust Exploitation | Elicitation relies on manipulating trust in the agent's responses and context handling. | |
| Recommendation — Constrain agent authority so elicitation cannot expose or reuse privileged context. Limit tool scope and validate requests to prevent extraction through tool abuse. Harden interaction design so user influence cannot coerce unsafe disclosures. | ||
| OWASP Non-Human Identity Top 10 | NHI-02 — Secret Leakage | The term directly concerns disclosure of sensitive values through MCP interactions. |
| NHI-04 — Insecure Authentication | MCP elicitation can expose authentication material or access-bearing tokens. | |
| NHI-05 — Overprivileged NHI | Elicitation becomes more damaging when the agent or connector can access too much. | |
| Recommendation — Redact or compartmentalize secrets before they can surface in agent context. Use stronger authentication flows that keep credentials out of conversational context. Reduce connector and agent privilege so disclosure cannot become broad compromise. | ||
| OWASP API Security Top 10 | API2 — Broken Authentication | MCP-facing services must authenticate and authorize access to prevent unsafe disclosure. |
| API5 — Broken Function Level Authorization | Tool access and exposed functions must be constrained to stop unauthorized requests. | |
| Recommendation — Enforce strong authentication on MCP endpoints and reject unauthenticated access. Authorize each MCP function so agents can only invoke approved operations. | ||
Practitioner Guidance
Why practitioners should care: MCP elicitation is a boundary problem, not just a prompt-quality problem. If an agent can be persuaded to ask for or relay sensitive material, then the protocol design, tool permissions, and context handling are part of the attack surface.
Governance implication: Treat MCP-connected tools and memory sources as data-bearing interfaces that need explicit authorization, scoping, and disclosure rules. The important judgement is not whether the model can answer a question, but whether the system should permit that question to reach the underlying data or control plane.
