The MCP attack surface
The Model Context Protocol (MCP) standardizes how AI models connect to external tools, data sources, and services. This connectivity is powerful — it enables agents to query databases, call APIs, read files, and interact with enterprise systems. It is also a significant attack surface. Every tool connection is a potential vector for prompt injection, data exfiltration, or unauthorized action.
The MCP architecture has three components: the host (AI application), the client (protocol connector within the host), and the server (external service exposing tools and resources). Security must be enforced at every boundary: host-to-client, client-to-server, and server-to-external-system.
Prompt injection through tool outputs
The most significant MCP security risk is prompt injection through tool outputs. When an agent calls a tool and receives a response, that response is fed back into the model's context. If the response contains crafted text — instructions disguised as data — the model may interpret them as commands and take unauthorized actions.
This is not a theoretical risk. Researchers have demonstrated attacks where a malicious MCP server returns tool outputs containing embedded instructions that cause the agent to exfiltrate data, call unauthorized tools, or modify its own behavior. The defense is to treat all tool outputs as untrusted input and evaluate them through the control plane before the model processes them.
Tool poisoning and supply chain risk
Tool poisoning occurs when an MCP server is compromised or malicious, returning crafted results designed to manipulate the agent. This is a supply chain risk: the agent trusts the tool because it is configured, but the tool's behavior has been altered. The agent cannot distinguish legitimate tool outputs from poisoned ones without external validation.
Defense requires: tool server integrity verification (cryptographic signatures on tool definitions and outputs), output validation (checking tool responses against expected schemas and value ranges), and behavioral monitoring (detecting when tool call patterns deviate from established baselines).
Governing MCP with a control plane
A control plane for MCP stacks intercepts each tool call before execution and evaluates it against policy, authority, and context. Policy: is this tool permitted for this agent? Authority: does the agent hold sufficient authorization for this action? Context: are the parameters within acceptable bounds? Is the target system in an appropriate state?
DecisionHypervisor's integration architecture supports MCP governance through its interceptor pattern: every consequential tool call is evaluated before reaching the MCP server. Unauthorized calls are denied. Anomalous calls are escalated. All calls are recorded in the tamper-evident evidence trail. This provides the governance layer that MCP stacks need without modifying the MCP protocol itself.