When MCP servers and adjacent components are loosely governed, they can become high-value pathways for prompt injection, supply chain manipulation, and unauthorised access. The failure is rarely a single exploit. It is usually a chain of trust assumptions that lets an attacker influence tool use, data flow, or execution boundaries without detection.
Why This Matters for Security Teams
MCP servers sit in the trust path between an AI agent and the tools, data, or actions it can invoke. When that layer is loosely governed, the issue is not just “bad configuration.” It is that untrusted prompts, unsafe tool exposure, and weak secrets handling can turn a control plane into an execution path. Current guidance suggests treating MCP as a privileged integration surface, not a convenience layer.
This is where security teams often underestimate exposure. An agent that can browse a catalog, call tools, and chain actions may look harmless until prompt injection or a compromised upstream component redirects its behaviour. The risk is amplified when secrets are embedded in configs, permissions are broad, or access scoping is absent. NHI Management Group research on the State of MCP Server Security 2025 found only 18% of deployments implement any form of access scoping for tool permissions, which shows how often control is missing before teams notice misuse.
The security concern is similar to what practitioners have documented in the OWASP Agentic Applications Top 10 and the OWASP Top 10 for Agentic Applications 2026: once a model or agent can select tools dynamically, the attack surface expands beyond the model itself. In practice, many security teams encounter MCP abuse only after a tool chain has already been influenced, rather than through intentional pre-deployment review.
How It Works in Practice
Effective MCP governance starts by treating each server, connector, and adjacent service as a workload with explicit identity, narrow permissions, and observable behaviour. That means no hard-coded secrets, no blanket tool access, and no assumption that the agent will only use tools in the way designers intended. The safer pattern is to issue short-lived credentials per task, bind them to workload identity, and evaluate authorisation at request time.
In practice, this means the server should authenticate as a distinct NHI, not as a shared service account, and the agent should receive only the minimum scope required for the current operation. Policy should be evaluated dynamically, using context such as requested tool, data classification, user intent, runtime location, and task phase. Frameworks like OWASP Agentic AI Top 10 and NIST’s AI governance guidance support this direction, while the Ultimate Guide to NHIs — Standards is useful for mapping the identity controls that should already exist around privileged workloads.
A practical control set usually includes:
- Tool-level allowlists with explicit deny defaults.
- Short TTL secrets and automatic revocation after task completion.
- Separate identities for inference, orchestration, and tool execution.
- Logging of tool selection, argument changes, and downstream calls.
- Policy-as-code for runtime decisions instead of static role assumptions.
Where teams get into trouble is assuming that a trusted MCP server makes every downstream action trustworthy. These controls tend to break down when multiple agents share the same connector, because one compromised workflow can inherit another workflow’s privileges and silently expand impact.
Common Variations and Edge Cases
Tighter MCP control often increases operational overhead, requiring organisations to balance developer velocity against containment and auditability. That tradeoff is real, especially in fast-moving agentic systems where tool catalogs change frequently and access needs vary by task.
There is no universal standard for this yet, so guidance is still evolving. Some environments can rely on coarse tool segmentation, while others need per-request policy evaluation and ephemeral secrets. Regulated workloads, production data connectors, and systems with external plugins should be treated more aggressively than internal prototypes. The AI Agents: The New Attack Surface report shows why: only 52% of companies can track and audit the data their AI agents access, so blind spots remain common even before MCP is introduced.
Edge cases also appear when a server is “trusted” but its dependencies are not. A clean MCP interface does not remove risk from vulnerable packages, stale tokens, or indirect prompt injection through retrieved content. Best practice is evolving toward layered controls, including workload identity, runtime policy checks, and continuous inspection of tool behavior. Organisations that ignore this usually discover the problem through credential exposure, unauthorized data access, or tool abuse after the fact, not during design review.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, CSA MAESTRO and OWASP Non-Human Identity Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Covers prompt injection and unsafe tool use in agentic workflows. |
| CSA MAESTRO | T1 | Addresses trust boundaries and control of autonomous agent toolchains. |
| NIST AI RMF | AI RMF governance is relevant to accountability for risky MCP-enabled behavior. | |
| OWASP Non-Human Identity Top 10 | NHI-03 | MCP failures often expose or overextend credentials and secrets. |
| NIST CSF 2.0 | PR.AC-4 | Least-privilege access control is central to MCP server containment. |
Restrict tool invocation with deny-by-default policies and inspect every agent action at runtime.
Related resources from NHI Mgmt Group
- What breaks when AI tools are exposed through loosely governed MCP servers?
- What breaks when AI project visibility and sharing are not tightly controlled?
- What breaks when AI workflows span separate MCP servers without orchestration?
- What breaks when MCPs and Skills are not tightly controlled on AI-enabled endpoints?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 28, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
