Topic starter
05/07/2026 6:55 pm
TL;DR: MCP connects AI applications to tools and data, but Lakera’s guide shows that prompt injection, data leaks, and unsafe outputs can still pass through unless inputs and outputs are screened at the tool boundary. The governance gap is not access alone, but what the model is allowed to do with access once context becomes executable.
Editorial analysis by NHI Mgmt Group, based on content published by Lakera: “How to Secure MCPs with Lakera Guard”.
Key questions
Q: How should security teams handle prompt injection in AI systems?
A: Treat prompt injection as an authorisation problem, not only a content problem.
Q: Why is access control alone not enough for AI tools connected through MCP?
A: Because the model can still process untrusted content and turn it into an unsafe action or output after access has been granted.
Q: What breaks when AI agents can call tools after reading untrusted content?
A: The system stops being a text processor and becomes an execution surface.
Practitioner guidance
- Screen prompts and resources at the MCP boundary Inspect inbound content before it reaches the model so hidden instructions, unsafe links, and data leaks are blocked before tool execution begins.
- Add output policy checks to model responses Apply the same inspection logic to generated text so unsafe summaries, exfiltrated data, and misleading instructions do not leave the system unchecked.
- Treat tool calls as governed actions Map every MCP tool to an approval and logging policy that records what content was processed, what decision was made, and what left the session.
Bottom line: MCP expands what AI systems can do, but it also creates a control gap when untrusted content becomes executable context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 7:17 pm
Content controls are now part of identity governance for AI tool use: MCP makes it clear that authenticated access is not the end of the control problem. Once a model can read prompts, resources, and tools, the governance question becomes what the runtime is allowed to do with that context. Practitioners should treat screening as a policy control at the action boundary, not as an optional content filter.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should teams govern prompts, tools, and resources in an MCP deployment?
A: Govern them as separate execution surfaces with shared policy enforcement. Prompts, tools, and resources all need input screening, output inspection, logging, and scope review because each can become a path for prompt injection or unsafe model behaviour.
👉 Read our full editorial: MCP security shows why AI tools need content controls