MCP Security Considerations for Enterprise AI
Security patterns for Model Context Protocol deployments — authentication, context boundaries, tool supply chains, and observability.
MCP expands the attack surface
Model Context Protocol connects models to tools and data. That power introduces new risks: over-privileged tools, context leakage, and unvetted server implementations.
Authentication and authorisation
Every MCP server should integrate with enterprise identity:
- Authenticate callers (host, user, service principal)
- Authorise tool invocations with least privilege
- Log tool requests and responses for audit
Context boundary controls
Context is not free-form memory. Define:
- What data can enter a session
- Retention and redaction rules
- Separation between untrusted user content and system instructions
Supply chain hygiene
Treat MCP servers like application dependencies: version pinning, code review, vulnerability scanning, and deployment isolation.
# Example: restrict network egress from MCP runtime
mcp-server start --bind 127.0.0.1 --egress-deny-allObservability requirements
Security teams need visibility into tool usage, failures, and anomalies — not only model outputs. Centralise logs and correlate with identity and workload identifiers.
Governance at scale
Catalogue approved MCP servers, document data classifications, and require security review before production promotion — the same discipline applied to APIs and microservices.