TL;DR: MCP only becomes useful in an AI SOC when the harness, evidence quality, and governance controls are stronger than the protocol itself, especially in multi-user environments with trace data, service accounts, and code execution, according to Corelight. The practical test is whether the system can show its work, stay attributable, and keep humans in control of the blast radius.
At a glance
What this is: This is a Corelight analysis of why MCP in an AI SOC depends more on governance, evidence, and harness design than on the protocol itself.
Why it matters: It matters because SOC teams and identity practitioners need attributable, bounded agent behaviour, not just faster queries, when traces, service accounts, and code mode touch sensitive security data.
Context
MCP, or Model Context Protocol, connects an AI model to tools and data sources, but the security problem is not the protocol alone. The real issue is whether the surrounding harness can preserve attribution, limit access, and keep evidence trustworthy when the model is used inside a security workflow.
In a single-user setup, the control burden is modest. In a multi-user SOC, the same pattern becomes a governance problem because traces can contain sensitive log data, prompts can be hostile, and service accounts can outlive the task they were meant to support. The article's starting position is typical for teams that move from demo to operational use.
Key questions
Q: What breaks when an AI SOC uses MCP without a governance harness?
A: Without a governance harness, MCP can blur attribution, expand tool access, and expose sensitive traces to people or processes that were never meant to see them. The result is not just poor model behaviour but weak accountability, unclear blast radius, and a workflow that can act on production data without adequate control.
Q: Why do traces and prompts need the same controls as security logs?
A: Because traces often contain copies or summaries of the same sensitive data the original logs hold. If they are stored, retained, or accessed more loosely than the source telemetry, you create a second, less controlled copy of privileged evidence. That breaks confidentiality and audit assumptions at the point the AI workflow starts to scale.
Q: What are the signs that an AI agent is overstepping its intended SOC role?
A: Warning signs include agents taking actions outside their assigned workflow, touching tools they do not need, making repeated escalations without clear evidence, or creating case changes that analysts cannot easily explain. If the SOC cannot reconstruct why the agent acted, the control model is already too loose.
Q: How should teams separate AI assistance from human accountability in SOC operations?
A: Teams should let AI enrich, correlate, and propose, while humans own escalation, approval, and post-incident review. That separation needs to be written into workflow policy so a tool can never silently convert analyst support into unsupervised response authority.
Technical breakdown
Why the harness defines MCP risk in a SOC
MCP does not replace the governance that already applies to the underlying logs, identities, and execution paths. In a SOC, the harness determines whether prompts, queries, traces, and tool calls remain attributable and bounded, or whether the model can wander across production data with unclear ownership. The key distinction is between a controlled retrieval workflow and a delegated execution path. Once code mode can query live systems, the risks become access scope, trace retention, and unreviewed side effects, not just model quality. See the AI Agent Authorisation Guide.
Practical implication: Treat the harness as a security control plane and define what each agent, analyst, and service account can reach before deployment.
How evidence and retention shape trustworthy AI investigation
The article's strongest point is that evidence sets the ceiling for useful AI assistance. If telemetry is missing, incomplete, or semantically inconsistent, the model cannot recover that gap, no matter how strong the reasoning layer is. Retention and trace storage also matter because traces can be copies of source security data, so they inherit the same confidentiality and audit requirements as the original logs. This makes data quality, schema design, and retrieval discipline foundational to any SOC MCP deployment. See the AI Agent Observability, Audit and Incident Response Guide.
Practical implication: Define evidence quality and trace retention requirements before scaling agent-assisted investigation.
Why prompts and tools need explicit trust boundaries
Prompt injection is a realistic risk when the input surface is hostile by design, which is often true for SOC telemetry and ingested logs. The article also draws a hard line between source-system authentication and model-layer reimplementation, because redoing auth inside the model stack weakens the original control model. Scoped service accounts, disposable execution environments, and a tested kill switch are therefore part of the architecture, not optional extras. That is especially important when the agent can act on production data or modify its own code. See the MCP Security Guide.
Practical implication: Separate read-only investigation from execution paths, and constrain every tool invocation to the minimum trust boundary needed.
Threat narrative
Attacker objective: The attacker aims to manipulate the agent's reasoning or execution path so the SOC workflow discloses sensitive data or performs unsafe actions under legitimate-looking access.
- Entry occurs when hostile content is ingested into SOC telemetry or prompts, creating a prompt-injection path through the MCP harness.
- Escalation follows when the agent is allowed to use over-scoped service accounts or code mode against production data without tight trust boundaries.
- Impact appears when the system exposes sensitive traces, performs unreviewed actions, or expands blast radius beyond the human operator's intent.
Breaches seen in the wild
- Smithery.ai MCP hosting breach 2025: A Smithery.ai build flaw gave GitGuardian a live fly.io token controlling 3,000+ hosted MCP servers and the API keys their clients sent.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Harness governance is now the primary control plane for MCP risk. The article makes clear that the protocol is not the hard part; the hard part is the wrapper around it, where attribution, access scope, trace handling, and execution limits are decided. That shifts security ownership away from the model alone and toward the workflow that binds model, logs, and tools together. In practice, teams that treat MCP as a mere integration layer will miss the real attack surface.
Trace data is effectively privileged data. Once a prompt or query pulls EDR or other security telemetry into traces, those traces inherit the sensitivity of the source system. That means trace storage, retention, and access control cannot be treated as convenience features. The governance question is not whether traces exist, but whether they are governed like the data they replicate.
Identity attribution is the difference between an assistant and a shared control plane. The article correctly calls for OAuth or an equivalent identity layer in multi-user settings so every prompt and action can be tied to a named human. Without that, AI-assisted investigation creates ambiguous accountability and weakens auditability across task-scoped access and delegated operations. Practitioner implication: identity, not just model output, must remain the auditable unit of control.
Prompt injection is an operational SOC issue, not an edge case. Ingested logs are hostile input by design, so the model must be treated as a system that can be steered through the data it reads. That is why bounded tool use, disposable execution environments, and a working kill switch matter. The implication for practitioners is simple: secure the input path as if it were an attack surface, because it is.
From our research library:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- Read next: AI Agent Observability, Audit and Incident Response Guide
What this signals
Knowledge ceiling: the model can only reason as far as the telemetry goes. In SOC deployments, AI does not create evidence, it only reorganises what already exists. That means missing telemetry, inconsistent field semantics, and weak schema design cap the value of the workflow before the model even starts. Teams that want better outcomes should improve data quality first, then evaluate the agent layer.
Control-by-design beats tool enthusiasm in agentic SOCs. The right question is not whether MCP is fashionable but whether the workflow can stay bounded, attributable, and reversible under pressure. That is why task-scoped access, disposable execution, and tested audit trails matter more than the protocol label. Practitioners should prepare for a world where the security standard is whether the system can prove what it did and why.
For practitioners
- Define read-only versus execution workflows Allow the agent to summarize, pivot, and retrieve first, then gate any action that can change state, touch production data, or modify code.
- Bind every prompt and action to a named human Require an identity layer that makes each analyst prompt, query, and tool invocation attributable, especially in multi-user environments.
- Treat traces like source telemetry Store prompts, outputs, and execution records under the same access controls and retention rules as the logs they were derived from.
- Isolate code mode in disposable environments Run any code-capable workflow in a container with scoped network access and a tested termination path so the blast radius stays bounded.
Key takeaways
- MCP in the SOC creates a governance problem as much as a technical one because traces, prompts, and tool calls can all carry sensitive evidence.
- The limiting factor is not the model's intelligence but the quality, retention, and accessibility of the telemetry it can reach.
- Practitioners should separate read-only investigation from execution, bind actions to named humans, and treat traces as privileged data.
Related NHI Mgmt Group resources: MCP Security Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Smithery.ai MCP hosting breach 2025
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article requires an identity layer so prompts and actions are attributable in multi-user MCP workflows. |
| NHI-05 — Overprivileged NHI | Scoped service accounts are central because the article warns against shared or over-scoped credentials. | |
| NHI-06 — Insecure Cloud Deployment Configurations | Disposable containers and scoped network access are part of the article's deployment boundary discussion. | |
| Recommendation — Use attributable authentication for every agent prompt, query, and tool action in shared SOC environments. Limit each MCP service account to the minimum task scope and revoke excess permissions before deployment. Constrain code-mode execution in isolated environments with tightly bounded network reach. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential scope and lifecycle control are essential to the article's model for governed agent access. |
| Recommendation — Apply IA-5 to manage, scope, and rotate credentials used by MCP services and agents. | ||
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | Prompt injection and over-scoped access create conditions for credential abuse and lateral movement in SOC workflows. |
| Recommendation — Map MCP abuse paths to credential access and lateral movement, then hunt for over-broad tool reach. | ||
Key terms
- Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
- Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
- Trace Retention: The policy and technical practice of storing the prompts, outputs, and execution records produced by an AI workflow. For security teams, traces are sensitive evidence, because they can expose source data, investigative assumptions, and action history, so they require the same governance as the logs they reflect.
- Task-Scoped Access: Task-scoped access is permission granted for one defined purpose and removed once the task is complete or the session expires. For non-human identities, it reduces standing privilege and limits how long an attacker can exploit a stolen credential.
Deepen your knowledge
The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader security workflows that now include AI agents and delegated tools.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org