gRPC for MCP raises the security bar for enterprise AI agents

At a glance

What this is: This article explains why FireCompass moved MCP from JSON-RPC to gRPC and finds that schema-first transport materially improves security, reliability, and performance for enterprise AI agents.

Why it matters: It matters because AI agent governance depends on transport, identity, and input validation as much as model behaviour, and weak MCP plumbing can undermine both NHI controls and autonomous execution safeguards.

By the numbers:

• By moving to a binary encoding format, message sizes shrink dramatically, up to 10x smaller.
• Payload efficiency improved by 75%+ after FireCompass replaced JSON-RPC with Protobufs.
• When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes, and as quickly as 9 minutes in some cases.
• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.

👉 Read FireCompass's analysis of gRPC transport for MCP and AI agents

Context

Model Context Protocol, or MCP, is the layer that connects AI agents to tools and data sources, so transport design directly affects identity, trust, and policy enforcement. In this article, FireCompass argues that JSON-RPC is too loose for enterprise agent workflows because dynamic payloads create avoidable security and reliability problems for AI agents that can initiate actions at runtime.

The broader governance issue is not just protocol preference. When agents can touch sensitive systems, the transport layer becomes part of the control plane, which means schema validation, mutual authentication, and streaming behaviour all shape how safely NHI and autonomous systems can operate.

Google Cloud’s reported support for gRPC as a native MCP transport is presented here as ecosystem validation, not as the core subject. The real takeaway for identity teams is that agent access paths now need the same level of design discipline as service-to-service authentication and privileged workload connectivity.

Key questions

Q: What breaks when MCP relies on loose JSON-RPC payloads for AI agents?

A: Loose JSON-RPC payloads weaken trust boundaries because the server must interpret commands before it can validate them. That creates exposure to type confusion, malformed tool calls, and context injection, especially when the agent can act at runtime. Schema-first transport reduces that ambiguity by making invalid input fail early instead of becoming a downstream security event.

Q: Why do AI agent transport decisions matter for identity governance?

A: Transport decisions matter because they determine where identity is verified, where input is trusted, and where policy can be enforced. If the connection layer is permissive, identity governance is forced to inspect behaviour after the agent has already crossed into execution. That is too late for sensitive tool access and autonomous workflows.

Q: What signs indicate an MCP-based agent architecture is failing security review?

A: Common warning signs include dynamic payload parsing, missing mutual authentication, no schema enforcement, and unlimited tool-call retries. If the architecture cannot prove who the agent is, what it sent, and how long a tool call may run, the environment is relying on assumptions rather than controls.

Q: How should security teams govern AI agents that use service accounts and MCP tools?

A: Start with ownership, then add runtime attribution and containment. Security teams should know which human deployed the agent, which identity the agent uses, what tools it can invoke, and when to revoke access. If the agent can chain tool calls or spawn sub-agents, governance must cover those paths as well, not just the initial login.

Technical breakdown

Why JSON-RPC creates weak trust boundaries for MCP

JSON-RPC is flexible, but that flexibility becomes a liability when an AI agent exchanges structured commands with tools that can change state. Dynamic payloads increase the risk of type confusion, malformed tool calls, and context injection because the server must interpret loosely defined input before it can enforce policy. In a security-sensitive agent workflow, the transport layer is not a neutral pipe. It is where the system decides whether the agent’s request is even structurally valid before any downstream action is allowed.

Practical implication: treat the MCP transport as a policy enforcement point and reject ambiguous input before it reaches execution services.

How gRPC and Protobufs improve agent identity and input assurance

gRPC shifts MCP toward strict schemas and binary message handling, while Protobufs force the client and server to agree on field structure in advance. That matters because schema validation turns malformed or malicious payloads into parse-time failures instead of runtime surprises. The article also notes native support for mutual TLS and token-based authentication, which strengthens peer verification between the agent and external tools. For identity teams, this is not just an engineering preference. It is a control design that narrows where trust is established and where it can be enforced.

Practical implication: align agent transport with mTLS and schema validation so authentication and input integrity are enforced at the same boundary.

Why streaming and backpressure matter for autonomous workflows

Agentic systems do not wait politely between calls, and downstream tools do not always respond at the same speed as the planner. gRPC adds bidirectional streaming, deadlines, timeouts, and backpressure, which helps stop tool requests from piling up or hanging indefinitely. That is especially important when an AI agent is orchestrating multi-step workflows across security or infrastructure tools. In practical terms, transport resilience becomes part of operational safety because the agent loop can fail closed instead of flooding dependent systems or stalling on an unbounded call chain.

Practical implication: define deadlines and backpressure policies for agent-tool interactions so runaway request loops do not become an availability risk.

Threat narrative

Attacker objective: The objective is to redirect agent execution through the MCP channel so the attacker can abuse tool access, steal sensitive context, or trigger harmful actions.

1. Entry occurs when a loosely typed MCP payload, bearer token, or intercepted connection gives an attacker an opening into the agent-tool trust boundary.
2. Escalation follows when malformed context or a stolen token is used to trigger unintended tool calls, hijack agent execution, or inject commands into the workflow.
3. Impact lands when the agent reaches sensitive tools or data paths and executes actions that were never intended by the original requester.

Breaches seen in the wild

• Moltbook AI agent keys breach — Moltbook breach exposed 1.5M AI agent keys.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Schema-first transport is becoming a governance control, not just an engineering preference. Once AI agents can invoke tools directly, the structure of the protocol determines how much trust the system can safely extend. Loose message formats and implicit parsing create governance ambiguity because policy enforcement happens after interpretation instead of before it. The implication is that identity teams must treat MCP transport choices as part of the access architecture, not as an implementation detail.

Dynamic payloads create an identity assurance gap for autonomous workflows. Standard MCP assumptions were built for early ecosystem flexibility, but enterprise agents need deterministic field validation and verifiable peer identity. That gap matters because an AI agent can pivot from planning to execution within a single runtime session, and a malformed command can become an access event if the transport layer is permissive. Practitioners should read this as a sign that runtime identity assurance now extends into protocol design.

mTLS and token binding shift trust from application logic to the transport boundary. FireCompass’s framing shows why mutual verification belongs at the connection layer when tools can mutate state or expose sensitive data. This is especially relevant for agentic AI, where the system is not merely requesting data but selecting actions at runtime. The practitioner takeaway is that the strongest control point may sit earlier in the chain than most identity programmes currently monitor.

Named concept: MCP transport trust debt. The longer an organisation depends on loosely typed, human-friendly message formats for machine-to-machine agent workflows, the more hidden risk accumulates in parsing, validation, and tool invocation. That debt shows up as brittle incident response, opaque auditability, and policy controls that cannot prove what the agent actually sent. Teams should treat the transport layer as a first-class governance surface.

The market is converging on stricter agent infrastructure because permissive plumbing does not scale to sensitive use cases. The article’s comparison with Google Cloud’s direction suggests that schema enforcement, streaming control, and peer authentication are becoming baseline expectations for production agent systems. That does not make every gRPC deployment secure, but it does raise the floor for what enterprise AI governance now has to assume. Practitioners should expect stronger coupling between identity, transport, and runtime safety.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation.
• That is why the OWASP Agentic Applications Top 10 and the NIST AI Risk Management Framework are increasingly relevant to runtime agent governance.

What this signals

MCP transport design is now part of agent governance. If an AI system can select tools at runtime, the protocol that carries its requests becomes part of the trust model. Enterprises should expect their identity reviews to move closer to connection assurance, schema enforcement, and session-level policy rather than treating integration plumbing as outside scope.

When agent ecosystems mature, auditability becomes the differentiator. The organisations that can prove what the agent requested, which tool accepted it, and how the session was bounded will have a materially better position for incident response and compliance. That is the practical line between controlled agent deployment and opaque automation.

With 80% of organisations already seeing AI agents act beyond intended scope, per the AI Agents: The New Attack Surface report, the governance problem is no longer speculative. Teams should align their controls to OWASP Agentic AI Top 10 and design for verifiable identity, bounded execution, and recoverable agent sessions.

For practitioners

• Move agent transport into the control model Document MCP transport as part of the identity architecture, not just the integration stack. Define who or what may call each tool, what schema is acceptable, and where connection-level trust is established.
• Require schema validation before execution Reject malformed or ambiguous agent payloads at the serialization layer so tool calls cannot be interpreted opportunistically. Use strict schemas for any agent that can reach sensitive systems or trigger state changes.
• Bind agent sessions with mutual authentication Use mTLS and token-based verification between agents and tools so both sides prove identity before context is shared. Do not rely on application logic alone to decide whether a connection is trusted.
• Set deadlines and backpressure for tool chains Cap request duration and concurrency so an overactive agent cannot flood dependent services or keep a workflow open indefinitely. Backpressure should be explicit in any multi-step autonomous execution path.

Key takeaways

• Loose MCP transport weakens assurance because it lets malformed or malicious agent input reach execution logic before controls can reliably stop it.
• FireCompass’s reported results show that schema-first gRPC handling improved payload efficiency by 75%+ and reduced message sizes by up to 10x, which is also an operational governance gain.
• Identity teams should treat agent transport, authentication, and session bounds as one control surface when AI systems can invoke tools autonomously.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Schema-first transport: A communication design in which message structure is defined before runtime exchange and invalid input is rejected early. For AI agents, this reduces ambiguity in tool calls and prevents loosely typed requests from becoming security events.
• mTLS: Mutual TLS is a transport pattern where both sides of a connection authenticate each other with certificates. In NHI programmes, it is often the control that binds service identity to encrypted traffic, but its value depends on certificate lifecycle, protocol version, and enforcement consistency.
• Tool Invocation Boundary: The control point where a system decides whether an agent can take a real-world action through a connected tool. It is a key enforcement layer for least privilege because it separates reasoning from execution and should block unsafe or unauthorised actions.

What's in the full article

FireCompass's full blog post covers the operational detail this post intentionally leaves for the source:

• Side-by-side architecture notes on the JSON-RPC to gRPC rewrite for Switchblade
• Benchmark methodology behind the reported payload, latency, and parsing gains
• Implementation details for mTLS, JWT or OAuth integration, and bidirectional streaming
• The article's examples of how schema enforcement blocks malformed tool calls before execution

👉 FireCompass's full post covers the Switchblade architecture, benchmark results, and MCP security rationale

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.