Cybersecurity glossary
What is the Model Context Protocol (MCP)?
Learn what the Model Context Protocol (MCP) is, how hosts, clients, and servers share tools and context with LLMs, and which security properties—authorization, pinning, and untrusted data—teams must get right.
Definition
The Model Context Protocol (MCP) is an open protocol that standardizes how LLM applications (hosts) connect to external tools, resources, and prompt templates (servers) over JSON-RPC, so agents can use a shared ecosystem of integrations instead of one-off plugins.
Why the Model Context Protocol matters
Before a shared protocol, every product invented its own function-calling glue. Model Context Protocol (MCP) standardizes that glue: a host application talks JSON-RPC to servers that offer tools, resources, and prompt templates.
That is good for builders and serious for defenders. One click can attach filesystem, browser, SaaS, and internal APIs to an LLM. The protocol does not decide whether those attachments are safe. Your catalog, identity, and runtime policy do.
How MCP fits together
Host starts a session
An IDE, desktop agent, or chat product loads configured servers.
Negotiate capabilities
Clients and servers declare what they support (tools, resources, prompts, extensions).
Discover tools and resources
Schemas and descriptions are fetched—this text is model-visible.
Model plans a call
The LLM chooses a tool and arguments from those descriptions.
Server executes
The server performs the action or returns resource content.
Result re-enters context
Output becomes the next observation, including any injected instructions.
What MCP standardizes—and what it does not
Tools
Callable actions with JSON schemas. Power and danger live here.
Resources
Readable context (files, tickets, URIs) that can carry indirect injection.
Prompts
Reusable templates. Treat them as code; they steer the model.
Not included
Your authorization policy, sandbox, and ‘should this agent have shell access.’
Security properties to add on top of MCP
| Property | If you skip it | If you enforce it |
|---|---|---|
| Server allowlist | Anyone’s community server becomes production code | Only reviewed publishers reach agents |
| Version pin | Rug pulls change tools after approval | Digest changes require a new review |
| User-scoped tokens | Server runs as a shared admin | Actions match the requesting user |
| Untrusted results | Tool output is treated as orders | Observations cannot freely enable new tools |
| Invocation logs | You cannot reconstruct an incident | Every call has actor, server, and args |
- Treat MCP as an integration bus, not as a security boundary.
- Allowlist servers per environment; block arbitrary installs on prod agents.
- Pin protocol and server versions; alert on unexpected capability changes.
- Review tool descriptions for instruction-stuffing before enablement.
- Use authorization on HTTP transports; pass user identity, not a global bot token.
- Sandbox servers that run local code or hit internal networks.
- Assume resource contents and tool results are untrusted text.
- Map MCP usage in your agentic AI threat model alongside [excessive agency](/glossary/excessive-agency).
The practical takeaway
Model Context Protocol (MCP) is how modern LLM apps attach tools and context through a shared JSON-RPC standard. It speeds integration and concentrates risk.
Govern the catalog, pin what you trust, bind calls to real identities, and treat everything a server returns as untrusted. The protocol connects the model to the world; your policy decides how much of the world it may touch.
Related security terms
MCP Server
The component that exposes tools, resources, and prompts to a host.
Agentic AI Security
The broader discipline for systems that use MCP to act.
Tool Poisoning
A leading attack against MCP tool metadata and implementations.
Excessive Agency
Risk of connecting too many powerful MCP servers to one agent.
Large Language Model (LLM)
The model that consumes MCP-provided context and tool results.
Frequently asked questions
What is MCP in simple terms?
It is USB-C for AI tools. Instead of every chatbot inventing its own plugin format, hosts and servers speak a shared protocol for tools, resources, and prompts.
Who are hosts, clients, and servers?
The host is the LLM app (IDE, desktop agent, chat product). It runs clients that connect to servers. Servers provide tools (actions), resources (data), and prompt templates.
Is MCP a model?
No. It is a connectivity standard. Security failures are in how you authenticate servers, authorize tools, and treat returned text—not in the protocol name itself.
Does MCP replace OAuth?
No. HTTP transports can use authorization (including OAuth-style flows). MCP does not magically grant least privilege; your token scopes still matter.
Why do security teams care?
MCP makes it easy to attach many integrations. That convenience is an agency and supply-chain expansion. Poisoned or over-scoped servers become the agent’s hands.
What changed in recent specs?
The protocol has moved toward more explicit capability negotiation and, in later revisions, more stateless request handling. Always pin the spec version you implement.
How should MCP be governed in a company?
Allowlist servers, pin versions, review tool descriptions, bind actions to user identity, and log invocations. Users should not install arbitrary community servers on production agents.
References
Explore authoritative guidance and frameworks related to model context protocol (mcp).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.