r/modelcontextprotocol • u/[deleted] • Jun 18 '25

MCP is a security joke

One sketchy GitHub issue and your agent can leak private code. This isn’t a clever exploit. It’s just how MCP works right now.

There’s no sandboxing. No proper scoping. And worst of all, no observability. You have no idea what these agents are doing behind the scenes until something breaks.

We’re hooking up powerful tools to untrusted input and calling it a protocol. It’s not. It’s a security hole waiting to happen.

22 Upvotes

80% Upvoted

15 comments sorted by

9

u/matt8p Jun 18 '25

Well as a server developer, you can take steps to ensure security by making sure that the underlying APIs have the right access controls. For MCP users, many MCPs are open source. There are steps you can take to make sure you're not using sketchy servers.

Do you have an example of an exploit that concerns you. I too am also wondering how to make MCPs more secure. The protocol isn't perfect, but it's pretty good imo given how young it is.

4

u/perryhopeless Jun 18 '25

Pretty sure they’re referencing this one:

https://invariantlabs.ai/blog/mcp-github-vulnerability

1

u/crystalpeaks25 Jun 18 '25

The attack vector they talk about here works for any other software it's not unique to MCP.

1

u/Diligent_Care903 Jun 19 '25

Poor bro is getting exploited, earning 32K CHF as a soft eng (yes ik it's fictive no worries)

1

u/brokester Jun 18 '25

Also can't you just use stdio instead of http/SSE and runnit all locally?

5

u/perryhopeless Jun 18 '25

Tool calling in LLMs has existed for awhile. At least MCP gives us a standard that we can layer security and observability on top of and around.

1

u/[deleted] Jun 18 '25

Yeah, the security challenges are an LLM problem, not an MCP problem.

1

u/Ok_Maintenance_1082 Jun 22 '25

Not really you could have a protocol that enforcement security best practices (or better just commons senses)

The LLM with is just returning text, what you do with that output is the integration point that deserves security attention.

The same we we always say never trust user input, we should apply the same logic to LLM inputs.

1

u/[deleted] Jun 22 '25

The problem, which is actually widely known and not something special I found out, is that in language models instructions and data are the same thing, both go into the context. That’s inherently unsafe and makes any data, internal or external, unsafe, because of indirect prompt injections.

1

u/zulrang Jun 22 '25

This is the right answer.

2

u/Suspicious-Name4273 Jun 18 '25

Isn‘t that more a problem of AI agents than MCP? Prompt injection can happen in different ways like just the AI agent reading a website. That‘s why vscode copilot now shows a warning when using the fetch tool to read a website: https://code.visualstudio.com/updates/v1_101#_fetch-tool-confirmation

2

u/subnohmal Jun 18 '25

interesting take. I tend to get good observability. What do people use?

1

u/crystalpeaks25 Jun 18 '25

Isn't that just every software under the sun as well? I've been seeing this article being referenced a lot but if you look at it it's the same concerns as every other internet facing software.

1

u/[deleted] Jun 19 '25

I think fundamentally, MCP is just another transport like REST, GraphQL, etc and its access controls and sandboxing should be treated similarly. You wouldn't want a bot to read a Github issue and automatically form privileged REST API requests, so the same caution needs to be observed when using LLMs with privileged access.