What Is Model Context Protocol?
The Model Context Protocol (MCP) is an open standard for connecting AI applications to external tools and data sources. An MCP server exposes tools, data and prompts in a common format, so any compatible AI application can use them without a custom integration.
Also known as:
How MCP Works
MCP uses a client-server design. The host is the AI application, such as a coding assistant or chat app. For each MCP server it connects to, the host creates an MCP client. Servers expose capabilities, mainly tools the model can call, resources it can read and prompt templates. Messages use JSON-RPC 2.0, and servers can run locally over standard input and output or remotely over HTTP.
Why MCP Matters
Before MCP, every AI application needed its own integration for every tool. MCP gives both sides one standard to build against, similar to how the Language Server Protocol standardized editor support for programming languages. Anthropic introduced MCP, and in December 2025 it became a founding project of the Linux Foundation's Agentic AI Foundation.
Security Risks of MCP
- Tool poisoning and prompt injection. Tool descriptions or returned content can carry instructions that steer the model.
- Over-privileged servers. A server with broad access gives any connected agent that access too.
- Confused deputy. A proxy server can be tricked into using its own authority on an attacker's behalf.
- Token passthrough. Servers that accept and forward tokens not issued to them bypass access controls.
- Untrusted servers. Installing a server means running someone else's code with your credentials.
The MCP specification states that tools represent arbitrary code execution and must be treated with caution, and that hosts must get explicit user consent before exposing user data to servers.
Securing MCP Servers You Build
- Scope each server's credentials to the minimum it needs.
- Validate every input, including arguments generated by a model.
- Require consent for sensitive actions and log every tool call.
- Review server code with the same rigor as any internet-facing API.
How Nullify Helps
An MCP server is application code, and it fails in the same ways. Nullify's code security analysis covers the vulnerability classes that matter most in server code, including injection, broken authentication and authorization, privilege escalation and SSRF. See how Nullify Code Security works.
Key Takeaways
- MCP is an open standard for connecting AI applications to tools and data.
- Hosts create one client per server, and servers expose tools, resources and prompts.
- Main risks are tool poisoning, over-privileged servers, confused deputy and token passthrough.
- Treat MCP servers like any internet-facing API: least privilege, input validation and logging.
Read More About Model Context Protocol
Code Security
See Nullify in Action
Nullify finds injection and authorization flaws in the code behind your AI integrations.