MCP attack vectors are the paths an attacker can use to abuse the Model Context Protocol and manipulate AI agents, tools, or data connections. They include prompt injection, tool poisoning, unauthorized tool calls, data exfiltration, and credential misuse. In practice, they target trust between agents, MCP servers, and connected systems.
What MCP attack vectors are
MCP attack vectors are the practical ways an adversary can abuse the Model Context Protocol to influence an AI agent’s behaviour, intercept its trust decisions, or reach connected tools and data through a compromised integration path.
They matter because MCP is designed to let agents interact with external systems through structured context, tool calls, and shared trust boundaries. OWASP Agentic Applications Top 10 is a useful reference point because it frames prompt injection, tool misuse, and identity abuse as first-class agentic risks rather than edge cases.
Common MCP attack paths
The most important attack paths are prompt injection, tool poisoning, unauthorized tool invocation, data exfiltration, and credential misuse. These often work by manipulating what the agent believes is safe, what it is allowed to call, or what data it should treat as authoritative.
A poisoned tool response or malicious upstream prompt can cause the agent to follow attacker-controlled instructions while appearing to operate normally. That is why MCP-specific guidance should include the authorization model itself, not just the agent. MCP Security Guide explains the protocol trust model, token passthrough concerns, and gateway patterns that shape these paths.
Why MCP attack vectors are dangerous
MCP attack vectors are dangerous because they exploit trust delegation. An attacker does not need to break the model directly if they can distort tool output, abuse a connected server, or make the agent carry out actions under legitimate-looking context.
This can turn a single compromised connector into broader exposure across data sources, SaaS tools, and internal systems. The risk is amplified when local or remote MCP servers are overtrusted, overly broad in scope, or connected to sensitive credentials and data flows. MCP Gateway and MCP Server Governance Guide is relevant here because approval tiers, allowlists, and audience-bound tokens directly reduce that exposure.
How organisations reduce exposure and respond
Organisations reduce exposure by treating MCP endpoints like privileged integrations: inventory them, review what data and tools they can reach, and validate whether the agent is allowed to use each capability at all. The safest MCP designs limit blast radius through scoped authorization, strict server governance, and careful separation between user intent and tool execution.
Operationally, teams should assume that a tool or server may be the attacker’s entry point and design for containment, logging, and rapid disablement. For identity and secret handling in these flows, NHI Authentication Guide provides the right context on API keys, OAuth client credentials, mTLS, workload federation, and other machine-authentication patterns that often sit behind MCP connections.
Risk and Threat Considerations
MCP attack vectors create a trust boundary problem: the agent may faithfully execute attacker-shaped instructions if context, tool output, or server behaviour has been manipulated. The most serious outcomes are unauthorised actions, hidden data leakage, and abuse of legitimate integrations at machine speed.
Failure mechanism: An attacker poisons prompts or tool content, then uses the agent’s normal authority to trigger unsafe tool calls or exfiltrate sensitive data through trusted connectors.
Impact: The compromise can spread beyond one agent session into connected systems, especially where the MCP server or upstream credentials are overprivileged or insufficiently governed.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and MITRE ATT&CK define the specific risk controls and attack patterns relevant to this term.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI02 — Tool Misuse | MCP vectors abuse tool invocation and agent-mediated actions. |
| ASI03 — Identity & Privilege Abuse | MCP attacks often exploit delegated authority and overbroad access. | |
| ASI09 — Human-Agent Trust Exploitation | Prompt injection and poisoned context exploit trust in agent decisions. | |
| Recommendation — Constrain agent tool access and validate every tool call path. Reduce delegated privilege and bind agent actions to least privilege. Separate user intent from untrusted context before executing actions. | ||
| MITRE ATT&CK | T1659 — Content Injection | Prompt injection is an adversarial content injection path into agent workflows. |
| T1552 — Unsecured Credentials | MCP abuse often seeks exposed tokens, keys, or other secret material. | |
| Recommendation — Detect and block injected instructions in prompts, tool outputs, and retrieved content. Harden secret handling and monitor for exposed credentials in integrations. | ||
Practitioner Guidance
What to watch for: Review MCP designs for any place where the agent can inherit trust from untrusted content, especially tool outputs, retrieved data, and server-provided instructions. That is where prompt injection and tool poisoning usually become operationally dangerous.
Governance implication: Treat MCP servers, registries, and gateways as governed security assets, not convenience plumbing. If a connector can call tools or reach secrets, it needs explicit ownership, approval, monitoring, and a defined offboarding path.