cyber.hendryadrian.com
Interesting Stuff · wiz.io

Wiz Outlines Model Context Protocol Security Risks and Safeguards

· Original article ↗

Summary

Wiz’s briefing explains security risks in Model Context Protocol (MCP), including unvetted local servers, remote-server abuse, and unsafe client auto-run, and recommends auditing, least privilege, sandboxing, and stronger governance.

Key points

  • Installing a local MCP server runs code on the machine; the article warns that unofficial registries and missing signing, pinning, and package locking increase supply-chain risks.
  • Registry labels and trust signals may not verify developer identity or guarantee that linked code matches the server package.
  • Remote servers may interact with client tools or permissions to access local files or exfiltrate tokens, and may handle sensitive authentication or customer data.
  • The article says client auto-run can increase the impact of a malicious or compromised server. It cites a Wiz proof of concept in which an external MCP server was exploited to achieve remote code execution on the MCP host.
  • Other client risks described include tool-name conflicts, slash-command hijacking, and indirect prompt injection through untrusted content.
  • For users, the article recommends auditing servers, limiting credential scope, using mature clients, and considering curated registries, sandboxing, egress controls, gateways, and allowlisting.
  • The article describes planned or emerging ecosystem safeguards, including an official registry and stronger integrity controls, isolation, namespacing, and permissions.

Article Details

Topic
Security risks and safeguards for Model Context Protocol (MCP) servers and clients

People

Gal NagliWiz employee who published a proof of concept demonstrating remote code execution on an MCP host through an exploited external MCP server.Guy GoldenbergWiz Software Engineer who found injection issues in Anthropic’s MCP PostgreSQL and Puppeteer servers.

Tools

hyper-mcpauthorization controls, secure secrets management, and standard containerized packaging via Docker. hyper-mcp is an alternative project, which instead uses WASM plugins. mcp.run is a vendor leveraging the WASMMCP Bridgemasking sensitive data and mitigating threats like prompt injection. Academics are also at work, with MCP Bridge as one example.MCP GatewayConsider an MCP gateway: Centralizing MCP Server usage through a proxy will allow a single point of control for audit logging and monitoring, as well as guardrails and governance controls.MCP Guardianbeing explored, which is an obvious extension to the LLM gateway approach. Two open-source options are MCP Guardian and MCP Gateway. The former offers auditing capabilities, message approvals, and server management.mcp.runpackaging via Docker. hyper-mcp is an alternative project, which instead uses WASM plugins. mcp.run is a vendor leveraging the WASM architecture, with a variety of additional safeguards. ToolHiveboundaries, and fine-grained resource constraints are gaining traction. The Stacklok team has announced toolhive, which offers a curated registry, authorization controls, secure secrets management, and standard

Related Articles