MCP Attacks.

Attacks that exploit the Model Context Protocol (MCP) to inject prompts, abuse tools, or pivot through servers an AI assistant trusts. It belongs to the AI & ML Security category of cybersecurity.

Attacks that exploit the Model Context Protocol (MCP) to inject prompts, abuse tools, or pivot through servers an AI assistant trusts.

MCP attacks target the Model Context Protocol, an open standard introduced by Anthropic that lets AI assistants connect to external tools, data sources, and applications through a common interface. Because an MCP server can expose tools, resources, and prompts to the model, a malicious or compromised server can inject hidden instructions, exfiltrate the user's data, request dangerous tool calls, or rebind tool definitions after the user has approved them (a 'rug pull'). Related techniques include tool description poisoning, cross-server confused-deputy attacks, and prompt injection via returned documents. Mitigations include signed and pinned server identities, scoped permissions, explicit consent per tool call, and sandboxing of MCP server processes.

Defences for MCP Attacks typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Model Context Protocol attack, MCP tool injection.