The MCP flaw is a design decision. Contain it now.
The Model Context Protocol’s core design — tools described in natural language, invoked by a model that reads untrusted content — is not a bug that will be patched. It is a standing condition to be contained. Here is how.
A malicious or compromised server can steer agent behavior through its own tool metadata — no exploit required.
Anything a tool returns — a web page, a ticket, an email — enters the same context window as your instructions.
Individually safe tools compose into unsafe sequences: read secret → encode → send. No single tool looks dangerous.
Long-running agent sessions keep credentials and context alive long after the operator stopped watching.
No direct model-to-tool path. Every invocation is classified, checked against policy, and logged before execution.
Wrap external content so the model treats it as data, never as instructions — and strip active instruction patterns.
Sessions expire, credentials rotate, and idle agents lose authority automatically.
Evaluate sequences of tool calls against exfiltration and escalation patterns — the risk lives in the composition.