MCP security risks: what enterprise identity teams are missing

TL;DR: MCP has become the default way to connect AI agents to enterprise tools, according to Willow, but the protocol ships without built-in authentication, leaves enforcement to implementers, and has already produced six critical CVEs plus research showing 43% of servers vulnerable to command injection. That combination turns MCP governance into an identity and control-plane problem, not just an application integration issue.

Editorial analysis by NHI Mgmt Group, based on content published by Willow: “The 10 MCP Security Risks Enterprise Teams Are Underestimating”.

By the numbers:

• Research shows 43% of MCP servers vulnerable to command injection.

Key questions

Q: What breaks when MCP deployments rely on the protocol for security boundaries?

A: The control boundary breaks first, because MCP does not supply native authentication or capability enforcement.

Q: Why do insecure credential handling patterns persist in MCP environments?

A: They persist because the protocol gives teams no shared credential lifecycle model, so each server invents its own storage and passing method.

Q: What are the signs that MCP governance is failing?

A: Common signs include agents reaching systems outside their intended workflow, incomplete audit trails for tool use, and data retrieval that cannot be tied back to a clear business purpose.

Practitioner guidance

• Define a central MCP authorisation policy Require a single policy layer for which agents, tools, and data sources may connect, rather than leaving each server to implement its own access rules.
• Block secrets from configuration files Move API keys and tokens into managed secret storage, and reject deployments that store credentials in world-readable config files or process-visible environment variables.
• Validate every tool schema field Scan parameter names, default values, type definitions, and non-standard fields, then remove anything that can influence model behaviour outside an approved contract.

Bottom line: MCP's core risk is not one bug but a missing trust boundary, because the protocol leaves authentication, authorization, and audit enforcement to implementers.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →