Model Context Protocol security needs identity-first access control

At a glance

What this is: This is an analysis of MCP security showing that protocol-level connectivity creates an identity and access control gap unless AI actions are bound to verified identities, scoped permissions, and audit trails.

Why it matters: It matters because IAM teams now have to govern AI-mediated access to production systems with the same rigour they apply to humans, service accounts, and other non-human identities.

By the numbers:

• 53% of MCP servers expose credentials through hard-coded values in configuration files.
• Only 18% of MCP server deployments implement any form of access scoping for tool permissions.

👉 Read AccuKnox's analysis of securing MCP with identity-first access control

Context

Model Context Protocol, or MCP, is a connectivity layer that lets AI systems call enterprise tools and data sources directly. The identity problem is not the protocol itself, but the fact that many deployments treat it as transport while skipping the access scoping, authentication, and traceability that govern every other privileged integration.

For IAM and NHI teams, MCP turns AI-mediated access into a policy enforcement problem rather than a simple integration choice. When an AI can retrieve data, trigger workflows, or provision resources, the real question is which identity is acting, what it is allowed to do, and how that action is recorded for audit and response.

Key questions

Q: What breaks when AI agents use MCP without strong scope enforcement?

A: Least privilege breaks in practice because the agent can execute far more than the business task requires. When tool permissions are broad, the difference between legitimate use and abuse becomes narrow, and a normal workflow can become a data exposure or unauthorized action path without any obvious boundary crossing.

Q: Why do MCP deployments complicate NHI governance?

A: MCP connects agents to tools in a way that can blur the line between a legitimate workload request and an uncontrolled execution path. For NHI governance, that matters because tokens, service accounts, and tool permissions are often managed separately, yet they now combine at runtime. If the request is not bound to identity and context, least privilege is only nominal.

Q: How do teams know whether MCP permissions are actually under control?

A: Look for separate read and write entitlements, explicit per-tool scoping, and complete logs for both permitted and denied actions. If tool access is inherited from a general user role without per-workflow limits, the control is probably too coarse to trust.

Q: Who is accountable when an AI agent takes action through an MCP server?

A: The accountable party is the human or team that authorised the agent's access, but only if the organisation can prove that chain. Without immutable logs that connect the initiating identity to the tool call and final action, accountability becomes weak, and legal or compliance teams lose the evidence they need.

Technical breakdown

Why MCP creates an identity enforcement gap

MCP standardises how models talk to tools, but it does not inherently define who the model is, what scope it has, or how requests are approved. That leaves deployments relying on adjacent controls such as API keys, session tokens, or proxy policy engines to supply identity governance after the fact. In practice, that makes the security boundary external to the protocol and easy to misconfigure.

Practical implication: treat MCP as a privileged access path and wrap it with identity, authorisation, and logging controls before allowing production use.

Why short-lived credentials matter for AI-driven actions

AI systems that act through MCP often inherit the risk of static secrets because long-lived credentials are easy to reuse across sessions and workflows. Short-lived credentials reduce blast radius by limiting the time window in which a token can be replayed or abused. The key design choice is whether the credential represents a fixed service identity or a session-bound action tied to a specific request and context.

Practical implication: replace reusable secrets with session-scoped credentials wherever AI tools can reach production systems.

How output controls fit into MCP governance

MCP risk is not limited to inbound prompts and tool calls. Responses can leak internal data, expose secrets, or generate unsafe code if output is not filtered before it reaches a user or downstream system. That makes response policy a governance layer, not just a content-safety feature, because the same session that is authorised to query data may still be barred from disclosing it.

Practical implication: add response inspection to the MCP control stack so authorised retrieval does not become unauthorised disclosure.

Threat narrative

Attacker objective: The attacker wants to turn AI-mediated tool access into a high-trust control path that exposes data, modifies systems, and weakens accountability.

1. Entry occurs when an AI system reaches enterprise tools through MCP using static credentials, broad tokens, or poorly scoped access to databases, APIs, or cloud services.
2. Escalation happens when the same identity can perform actions beyond the original user intent, such as querying sensitive records, modifying workflows, or provisioning resources without real-time policy checks.
3. Impact follows when those over-broad actions lead to data exposure, workflow manipulation, or compliance failure because the organisation cannot attribute what the AI accessed or changed.

Breaches seen in the wild

• Cisco DevHub NHI breach — IntelBroker exploited exposed Cisco credentials, API tokens and keys in DevHub.
• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

MCP security is an identity problem before it is a protocol problem. The architectural failure is assuming that a functional connector can safely inherit trust from the model or the surrounding platform. In reality, MCP turns tool access into a privileged control plane, so authorisation, scoping, and traceability must exist at the session boundary, not only in the backend systems. Practitioners should treat MCP as a governed identity path, not a neutral integration layer.

Static credential dependence is the wrong operating model for AI-mediated access. The 2026 Infrastructure Identity Survey found that 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments. That is a strong signal that the old secret lifecycle model is colliding with AI systems that can chain requests across tools and services. The result is not just more exposure, but longer-lived trust debt that accumulates across every integration point.

Identity blast radius is the right concept for MCP governance. Identity blast radius: the amount of data, action scope, and system reach a single AI session can affect before policy stops it. MCP deployments often widen that radius by granting one identity access to multiple backend systems under one token or proxy. Practitioners should measure how far one request can travel, not just whether the gateway is authenticated.

Least privilege must be enforced at the action level, not inferred from the application context. AI systems do not reliably preserve the user's original intent once tool calls begin, especially when multi-step workflows are involved. That means the access decision has to be made against the specific requested action, the data sensitivity, and the live threat posture. If those signals are not evaluated together, MCP becomes a bypass around normal IAM discipline.

Auditability is now a core control, not an afterthought. When AI actions are mediated through MCP, every approved or denied request needs to be attributable to a specific identity, resource, and policy decision. Without that, compliance teams cannot prove what the AI saw, touched, or changed. The practitioner takeaway is straightforward: if an AI action cannot be reconstructed, it was not governed well enough to trust.

From our research:

• Only 18% of MCP server deployments implement any form of access scoping for tool permissions, according to the State of MCP Server Security 2025.
• Another finding from the same research shows that 53% of MCP servers expose credentials through hard-coded values in configuration files.
• For a broader governance lens, the Ultimate Guide to NHIs explains how access scoping, rotation, and lifecycle control should work across non-human identities.

What this signals

Identity blast radius: MCP will accelerate the shift from static integration review to runtime control review. As AI systems begin calling more enterprise tools directly, IAM teams will need to measure how far one identity can travel across data, APIs, and cloud actions before a policy decision intervenes.

The governance gap is not just technical, it is operational. Teams that still think in terms of endpoint allowlisting alone will miss the larger issue of session-scoped authorisation, immutable audit evidence, and response-time containment when AI-driven access crosses system boundaries.

For practitioners

• Scope every MCP server to a named identity Bind each AI session to a verifiable identity with explicit tool permissions, resource limits, and revocation rules. Do not allow anonymous access or shared credentials across workloads.
• Replace long-lived secrets with short-lived session credentials Use certificates or tokens that expire quickly and are tied to the exact AI task, then revoke them automatically when the session ends. This reduces replay risk and narrows the misuse window.
• Enforce request-level policy before any tool call executes Evaluate the requested action, the actor context, and the target resource in real time so the AI cannot exceed its intended scope. Block unauthorized writes before they reach the backend.
• Log every approved and denied MCP action immutably Capture the requesting identity, target resource, action attempted, and policy decision in a form that supports investigation and compliance review. If you cannot reconstruct the event, you cannot govern it.
• Inspect responses for data leakage and unsafe output Scan AI outputs for secrets, sensitive records, and insecure code before they are displayed or passed downstream. Pair response policy with input policy so retrieval does not become disclosure.

Key takeaways

• MCP exposes a control gap because connectivity is not the same as authorisation, and AI tool access needs explicit identity scoping.
• The strongest evidence in the market points to weak tool-permission scoping and widespread secret exposure, which widens the attack surface quickly.
• Practitioners should govern MCP like privileged access, with short-lived credentials, request-time policy checks, and complete audit trails.

Key terms

• Model Context Protocol: Model Context Protocol is an open protocol that lets AI agents connect to tools and data sources. It expands what an agent can reach, so governance has to cover not only the model and its prompts, but also every system that can receive or return agent-driven data.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Per-Session Credential: A short-lived credential issued for one task or invocation rather than for a long-lived workload identity. It reduces standing privilege, but it only improves security when runtime instrumentation can prove the credential actually matches the task scope.
• Request-level Authorization: Request-level authorization means access is decided for each request rather than once at login or network entry. It lets operators scope permissions by route, method, and identity, which is far more precise than broad network access and better suited to distributed systems and NHIs.

What's in the full article

AccuKnox's full article covers the operational detail this post intentionally leaves for the source:

• Detailed policy flow for prompt firewalling and response sanitisation across MCP-connected workflows
• Implementation guidance for short-lived certificates, request validation, and immutable audit logging
• Examples of how the control stack is integrated with CSPM, CWPP, and Kubernetes runtime protection
• Compliance mapping detail for NIST AI RMF, EU AI Act, and OWASP AI Top 10

👉 The full AccuKnox article covers the MCP threat patterns, layered controls, and compliance mappings in more implementation detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.