Cybersecurity glossary
What is an MCP Server?
Learn what an MCP server is, how it exposes tools, resources, and prompts to LLM hosts, why a malicious or over-scoped server is a production incident, and how to pin, sandbox, and authorize servers.
Definition
An MCP server is a process or service that implements the Model Context Protocol and exposes tools, resources, and/or prompt templates to an LLM host. It is the integration endpoint the model can discover and invoke—equivalent to a plugin with a standardized RPC interface.
Why MCP servers matter
The protocol is abstract. MCP servers are concrete: a Node process with your GitHub token, a remote HTTP service that can query a warehouse, a local bridge to the user’s files. That is where credentials live and where side effects happen.
If you only review ‘whether we use MCP’ and never inventory servers, you have not reviewed the attack surface. Each server is an API plus a natural-language UI aimed at the model.
What a server typically offers
Advertise capabilities
The server declares tools, resources, and prompts the host may use.
Publish schemas
JSON schemas and English descriptions are sent to the host and then to the model.
Receive a tool call
The host forwards the model’s chosen name and arguments.
Authorize the action
A well-built server checks the user token and policy before doing work.
Touch the real system
Tickets, files, cloud APIs, or browsers are read or changed.
Return observations
Results go back into the model context for the next step.
Trust tiers for servers
First-party internal
You wrote it, you hold the keys, you can force least privilege and logging.
Vendor official
A SaaS publisher’s server. Still pin versions and scopes; still a supply chain.
Community / unknown
High tool-poisoning and rug-pull risk. Default deny on production agents.
User-installed local
Shadow AI: an employee’s laptop running a server with their SSO cookies.
Server configuration that changes blast radius
| Setting | Risky default | Safer default |
|---|---|---|
| Identity | Static admin PAT in env | On-behalf-of user OAuth with tight scopes |
| Network | Server on host network with egress anywhere | Egress allowlist; no metadata endpoints |
| Filesystem | Home directory or repo root writable | Narrow workspace; no secrets paths |
| Updates | Auto-update from latest | Pinned digest; change ticket for upgrades |
| Discovery | Model can add servers | Humans add servers; agents cannot |
- Inventory every MCP server in use: publisher, digest, scopes, data class, owner.
- Prefer first-party servers for sensitive systems; treat community servers as untrusted code.
- Pin versions; require review when tool lists or descriptions change.
- Sandbox local servers; do not run them as the user with full home-directory access unless that is the product.
- Put authorization in the server, not only in the model’s manners.
- Log calls with server ID, tool name, and actor.
- Block servers that request overlapping lookalike tool names against your allowlist.
- Include MCP servers in vendor risk and software supply chain reviews.
The practical takeaway
An MCP server is the actual plugin: tools, credentials, and data behind a standard RPC. The protocol makes it easy to attach; the server decides what ‘attach’ means in production.
Allowlist and pin servers, give them user-scoped tokens, sandbox their reach, and read their descriptions as model-visible code. If you would not give a contractor that token, do not give that MCP server to an agent.
Related security terms
Model Context Protocol (MCP)
The protocol the server implements.
Tool Poisoning
Attacks that tamper with a server’s tool metadata or code.
Shadow AI
Unapproved MCP servers employees add to personal agents.
Agentic AI Security
How servers fit into the agent tool graph.
AI Supply Chain
Servers are third-party artifacts that need provenance.
Frequently asked questions
What is an MCP server in simple terms?
It is a small app that offers actions and data to an AI assistant: ‘list tickets,’ ‘read this file,’ ‘create a PR.’ The assistant talks to it using MCP.
How is a server different from the protocol?
MCP is the language. The server is one speaker: a GitHub integration, a database gateway, or a local filesystem bridge.
Where do servers run?
Locally next to the host, in a container, or remotely over HTTP. Location changes the sandbox and network story.
Why can one server be so dangerous?
Whatever it can do, the model can request. A filesystem server is read/write to disk. A cloud server is your cloud API with whatever token you gave it.
What is a malicious MCP server?
One that steals context, uses lookalike tool names, includes poisoned descriptions, or changes behavior after you installed it (rug pull).
Should developers write internal MCP servers?
Yes, often that is safer than community servers—if you apply OAuth, least privilege, and the same review you give internal APIs.
How do you operate servers safely?
Allowlist, pin digests, sandbox, user-scoped auth, description review, and logs. Do not run untrusted servers with production secrets.
References
Explore authoritative guidance and frameworks related to mcp server.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.