Known MCP Vulnerabilities and How an MCP Gateway Blocks Them
The Model Context Protocol introduces new attack vectors for AI agents, such as tool poisoning and command injection, by allowing dynamic tool discovery and execution. Centralized MCP gateways enforce schema validation, scoped authentication, and runtime guardrails to neutralize these threats. Depl…
The Model Context Protocol (MCP) has become the de‑facto standard for connecting large language models (LLMs) to external tools. While it simplifies agent integration, it also opens a host of new security risks that traditional web‑app defenses are ill‑prepared to handle.
What Is at Stake?
MCP lets an LLM discover and invoke tools by fetching a JSON schema from a server. The schema contains tool names, parameters, and plain‑text descriptions that the model uses to decide how and when to call the tool. Because the model treats these descriptions as authoritative, an attacker who can tamper with the schema can steer the agent into executing malicious actions—reading private files, injecting shell commands, or exfiltrating credentials.
High‑severity CVEs such as CVE‑2025‑54073 and CVE‑2026‑33032 demonstrate how unsanitized transport parameters and unvalidated tool metadata can lead to remote code execution and unauthorized service manipulation.
Common Attack Vectors
- Tool Poisoning – An attacker injects malicious instructions into a tool’s description. The LLM then follows those instructions, for example, reading a private SSH key and sending it back to the attacker.
- Command Injection via STDIO – MCP servers that forward model parameters to host shells can be tricked into executing arbitrary shell commands when the model’s output contains metacharacters.
- Tool Shadowing & Mid‑Session Rug Pulls – A malicious server registers a tool with the same name as a trusted one, then later updates the schema to include harmful parameters once the agent has established trust.
- Broken Authentication – Many MCP deployments expose HTTP/SSE endpoints without mandatory OAuth or mutual TLS, allowing unauthenticated actors to trigger server actions.
- Excessive Agency – When a server grants broad permissions—full read/write/delete—an LLM can perform destructive operations if it receives an indirect prompt injection payload.
Why Point‑to‑Point Connections Fail
Direct connections between an agent and an MCP server create three critical blind spots:
- Context Visibility – Security teams cannot see the JSON payloads that travel over local STDIO or independent HTTPS tunnels.
- Static Credential Sprawl – Long‑lived tokens and database passwords are scattered across developer machines, CI runners, and local config files, increasing the attack surface.
- Request‑Time Access Control – Traditional API gateways cannot interpret MCP’s JSON‑RPC structure, so they cannot enforce fine‑grained permissions on tool calls.
Enter the MCP Gateway
An MCP gateway sits between every AI client and the upstream tool servers. It terminates the protocol, validates schemas, and applies enterprise policies before forwarding requests. The open‑source Bifrost gateway, written in Go, demonstrates how this architecture works in practice.
Bifrost performs several key functions:
- Schema Sanitization – It strips untrusted natural‑language instructions from tool definitions and replaces verbose tool lists with a small set of meta‑tools, cutting context token usage by up to 92%.
- Tool Filtering & Grouping – Administrators define allowlists that limit which tools an agent can see, preventing shadow tools from appearing in the catalog.
- Scoped Authentication – Agents authenticate to the gateway with a virtual key. The gateway then attaches the appropriate upstream credentials (OAuth 2.0, PKCE, or API keys) on demand, eliminating static secrets on endpoints.
- Parameter Validation & Sandbox Isolation – All tool arguments are checked against strict type schemas. Execution occurs inside isolated containers or VPC endpoints, so a compromised model cannot affect the host workstation.
- Real‑Time Guardrails & Audit Logging – The gateway logs every tool invocation and enforces runtime policies, providing SOC 2‑style visibility and compliance.
By presenting a single, governed endpoint to developers while orchestrating connections to multiple upstream providers, Bifrost turns a chaotic mesh of MCP servers into a tightly controlled, auditable environment.
What Comes Next?
Organizations that already rely on autonomous AI agents should evaluate whether their current MCP connections are point‑to‑point or gateway‑mediated. Deploying a gateway is the most effective way to mitigate known vulnerabilities, enforce least‑privilege access, and maintain compliance with data‑protection regulations. As the AI ecosystem evolves, centralized control planes will become essential for protecting both infrastructure and data.
Why it matters
MCP vulnerabilities expose critical systems to data theft and remote code execution. A gateway provides the necessary controls to keep AI agents from becoming a backdoor into corporate networks.
Key points
- MCP’s dynamic tool discovery creates new attack vectors like tool poisoning and command injection.
- Direct agent‑to‑server links lack visibility, credential safety, and fine‑grained access control.
- An MCP gateway validates schemas, filters tools, and enforces scoped authentication to neutralize risks.
- Bifrost replaces raw tool lists with meta‑tools, cutting context size and injection surface.
- Centralized gateways provide audit logs and compliance‑ready guardrails for production AI workloads.
Frequently asked questions
What is tool poisoning?
It occurs when an attacker injects malicious instructions into a tool’s description so the LLM follows them, potentially exfiltrating data or executing harmful actions.
How does an MCP gateway prevent command injection?
By validating all tool arguments against strict schemas and executing calls inside isolated containers, the gateway stops malicious shell metacharacters from reaching the host system.
Do I need to replace all my MCP servers with a gateway?
Not necessarily; you can deploy a gateway to mediate existing servers, adding a layer of control without rewriting your tool infrastructure.
