Cross-MCP abuse is misuse of one Model Context Protocol connection to reach tools, data, or permissions intended for another connection or context. It happens when an agent, client, or intermediary can invoke the wrong server, reuse a session, or cross trust boundaries because of weak isolation, routing, or authorisation checks.
What Cross-MCP Abuse Is
Cross-MCP abuse is not just a routing mistake, it is a trust-boundary failure. The core issue is that one Model Context Protocol connection can be used to reach tools, data, or permissions that belong to a different connection or context, so the security promise of “this agent, this session, this server” breaks down.
That matters because MCP is often used to separate capabilities by server, user, workspace, or task. When those separations blur, an apparently valid request can inherit the wrong authority, which makes the abuse harder to notice than a straightforward authentication failure.
How Cross-Context Leakage Happens
Cross-context leakage usually appears when isolation is too weak at one of three points: connection handling, session handling, or authorisation handling. A client or intermediary may reuse a session across contexts, route a request to the wrong MCP server, or accept a token or capability that was intended for a different trust boundary.
In practice, this can look like one agent’s tool call landing in another agent’s environment, a shared gateway collapsing separate tenants, or a server trusting metadata that should have been bound to a specific conversation or workspace. The failure is architectural, not cosmetic: the system has lost the ability to prove which context is actually authorised.
Why It Becomes Dangerous
Once boundaries blur, the attacker does not need to “hack” the correct server if they can induce the platform to reuse the wrong one. That can expose data, trigger actions in another context, or let a lower-trust workflow borrow permissions that were meant to be isolated.
This is especially serious in agentic systems because tool access is often more powerful than simple read access. A cross-context mistake can turn a single confused request into data exposure, unintended actions, or privilege amplification across multiple MCP integrations.
What Good Defence Looks Like
Defence starts with explicit binding between connection, session, identity, and target server. Strong implementations keep routing decisions and authorisation decisions tied to the same context, rather than assuming a shared gateway or client session is safe by default.
Teams should also treat MCP transport and trust boundaries as part of the security design, not as plumbing. The Model Context Protocol: Authorization specification is useful here because it explains token audience boundaries and why token passthrough creates risk.
For broader agent control, NHIMG’s OWASP Agentic Applications Top 10 helps frame cross-context abuse alongside identity and privilege abuse, while the MCP Incident Response Playbook covers what to do when an MCP server or connection is suspected of being abused.
Risk and Threat Considerations
Cross-MCP abuse creates a direct path from weak isolation to unintended access. The security failure is often subtle because each individual request may look legitimate, while the real problem is that the request has crossed into a different trust context than the one it was authorised for.
Failure mechanism: A client, agent, or intermediary reuses a session, misroutes a tool call, or accepts an access token without binding it tightly enough to the intended MCP server or context. That lets the wrong authority be applied to the wrong target.
Impact: The result can be cross-tenant data exposure, unauthorised tool execution, privilege misuse, or the compromise of one workflow through another workflow’s permissions and state.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 and OWASP API Security Top 10 address the attack and risk surface, while NIST SP 800-53 Rev 5 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | ASI03 — Identity & Privilege Abuse | Cross-MCP abuse can reuse or misapply agent authority across contexts. |
| ASI02 — Tool Misuse | The term centers on an agent or intermediary invoking the wrong tool or server. | |
| ASI07 — Insecure Inter-Agent Communication | Cross-context abuse often arises when messages, sessions, or trust boundaries are weakly separated. | |
| Recommendation — Bind each MCP action to the correct agent identity, context, and least-privilege scope. Constrain tool routing so requests can only reach explicitly authorised MCP servers. Separate inter-agent channels and reject messages that are not context-bound. | ||
| OWASP API Security Top 10 | API5 — Broken Function Level Authorization | Cross-MCP abuse can let a caller use a function or tool path not intended for that context. |
| Recommendation — Enforce function-level authorisation on every MCP tool call, not just at login. | ||
| NIST SP 800-53 Rev 5 | AC-3 — Access Enforcement | The term is fundamentally about enforcing the right access in the right trust boundary. |
| Recommendation — Enforce context-specific access decisions for each MCP connection and tool invocation. | ||
Practitioner Guidance
What to watch for: Investigate any MCP design that relies on shared gateways, shared sessions, broad bearer tokens, or implicit server selection. Those patterns are where context confusion usually appears first.
Practitioner note: The safest designs make the intended server, user, and task explicit at every authorisation decision, then log enough context to show when a request crossed a boundary. That makes cross-MCP abuse easier to prevent, detect, and investigate.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on November 2, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org