Topic starter
27/10/2026 7:13 pm
TL;DR: MCP servers expand AI agent attack surface through tool poisoning, excessive permissions, cross-server leakage and data exfiltration via tool parameters, according to Repello AI, making pre-install and post-install testing essential before connecting them to agents. The control problem is not just trust in one server, but whether the host can govern tool descriptions, parameter boundaries and chained tool use.
Editorial analysis by NHI Mgmt Group, based on content published by Repello AI: “MCP Server Security Testing: How to Find Vulnerabilities in Model Context Protocol Integrations”.
Key questions
Q: What breaks when MCP access is managed separately in each AI client?
A: Governance fragments quickly when each client keeps its own access list.
Q: Why do MCP servers increase risk when tool permissions are too broad?
A: MCP servers can expand risk because they sit between an AI client and sensitive backends, often with enough reach to query data, trigger workflows, or modify records.
Q: How can security teams spot unsafe MCP server behaviour?
A: Look for servers that request secrets, widen access unexpectedly, or accept tokens that were not clearly approved for the current task.
Practitioner guidance
- Review tool descriptions before connection Inspect every advertised tool for hidden instructions, unusual wording and references to data or files outside its stated purpose.
- Constrain the permission surface Document what each tool can read, write, query or transmit, then reject integrations whose parameters are too open-ended for the task.
- Separate trust domains by session Run broad-access MCP servers in a different AI session from untrusted or experimental servers so one toolchain cannot shape another.
Bottom line: MCP servers expand the AI agent attack surface because tool descriptions, parameters and responses can all be abused.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →