Why MCP is a security question
MCP is an open protocol that lets AI agents call tools and read data from other systems. That is what makes agents useful, and it is also why they need controls: an agent connected through MCP can do whatever the connection allows.
For a business buyer the key idea is delegation. Whatever access you approve, the agent holds. Security is mostly about how much you hand over, how it is checked, and whether you can see what happened.
What the 2026 specification changed
According to SiliconANGLE’s report on Akamai’s analysis, the MCP revision dated 2026-07-28 removes three older risks: protocol-managed sessions that used the Mcp-Session-Id header, unsolicited server prompts, and weak OAuth grants, which are replaced by mandatory OAuth 2.1 with PKCE.
Removing server-side sessions moves state to the client. Akamai’s researchers identified six areas to watch:
- Client-held state: predictable IDs or unvalidated objects could let an attacker hijack a workflow.
- Unsigned metadata: a forged field could escalate privileges.
- Header and body mismatch: requests can slip past proxies and monitoring.
- Header mapping: keys or personal data could end up in headers that logs can see.
- Interactive panels: stored cross-site scripting could show deceptive content.
- “Hit-and-run” tasks: an abandoned long-running task can leave the server bearing the cost.
This is researchers’ analysis of a specification, not a report of attacks seen in the wild.
The OWASP MCP Top 10 in plain English
The OWASP MCP Top 10 is a beta project, labelled with the 2025 edition. The names are OWASP’s; the plain-language reading is ours.
- MCP01 Secrets exposure: long-lived or hard-coded credentials leak.
- MCP02 Scope creep: permissions grow until the agent can do more than it needs.
- MCP03 Tool poisoning: a compromised tool feeds misleading context to the model.
- MCP04 Supply chain: a tampered dependency changes agent behaviour.
- MCP05 Command injection: the agent runs commands built from untrusted input.
- MCP06 Prompt injection: hidden instructions in content the agent reads steer it.
- MCP07 Weak authentication: servers fail to verify who is calling.
- MCP08 No audit trail: actions are not logged, so incidents cannot be investigated.
- MCP09 Shadow servers: unapproved MCP deployments run outside governance.
- MCP10 Context over-sharing: one task’s data leaks into another.
Least privilege in practice
A concrete example comes from Cloudflare. Its API MCP server now supports step-up authorization: you grant only the scopes a task needs when you connect, and a client that supports it asks you to approve more when a tool call needs them. Cloudflare’s consent page also offers a Minimal option.
Cloudflare has also retired the /sse endpoint on its product-specific servers, which now serve only /mcp. Older client settings that still point at /sse receive a 410 Gone response. The point for buyers is that a supplier should be able to explain both what access an agent starts with and how it asks for more.
Questions to ask any agent supplier
- What is the agent’s exact permission list, and who reviews it?
- Where are its credentials stored, and how often are they rotated?
- Can I see a log of everything the agent did last week?
- Which MCP version do your servers run, and how do you verify client-supplied state?
- Is there an inventory of every MCP server and tool the agent can reach?
- What happens if a document or email tells the agent to ignore its rules?
- Is customer data kept separate between tasks and users?
- Does a person approve any action that changes production?
For how to bound an agent’s authority, see our whitepapers on AI agents for business and the AI governance checklist.
Sources
- SiliconANGLE, New MCP specification kills old risks, opens fresh attack surfaces, Akamai finds, June 25, 2026
- OWASP, MCP Top 10 project (beta, 2025 edition labels)
- Cloudflare, API MCP server now supports step-up authorization, changelog, October 19, 2026
- Cloudflare, MCP servers no longer serve /sse, changelog, October 22, 2026
Frequently asked questions
What is MCP?
The Model Context Protocol is an open standard that lets AI agents connect to tools and data, such as a calendar, a database or a cloud account, through one common interface.
Is the new MCP specification more secure?
It removes some older risks, including protocol-managed sessions and weak OAuth grants, but Akamai researchers also identified new attack surfaces because responsibility for verifying state moved to implementers.
What is the OWASP MCP Top 10?
An OWASP project listing the ten most likely ways to compromise an MCP deployment. It is in beta and labelled with the 2025 edition, so use it as a question sheet and expect changes.
What should I ask an agent supplier first?
Three things: what permissions the agent has and who reviews them, where its credentials are stored and how often they rotate, and whether you can see a log of everything it did last week.
What you get:
- What changed in the 2026 MCP specification and what it opened up
- The OWASP MCP Top 10 in plain language
- A least-privilege example: step-up authorization on a real MCP server
- Eight questions to ask any agent supplier
- Where to go next for agent governance