AI Security
What Is MCP Security?
- Tool calls
- MCP servers
- Agent data
Short answer
MCP security covers the risks of connecting AI models and agents to tools through the Model Context Protocol: what data flows into tool calls, what tool results expose to the model, which servers you trust, and who approves what an agent may do. It combines server vetting, least-privilege credentials, approval steps and masking of tool-call data.
What is MCP?
The Model Context Protocol is an open protocol for connecting AI applications to tools and data. Anthropic introduced it in November 2024, and in December 2025 donated it to the Agentic AI Foundation, a fund under the Linux Foundation. An MCP host (a chat app, an IDE, an agent) runs clients that talk to servers. Servers expose tools, and the model calls them with JSON-RPC tools/call requests.
That design is what makes MCP useful: one CRM server works with any MCP-capable agent. It's also what makes it a data channel. Every call moves data out of the model into a server, and every result moves data from the server into the model.
Where does data flow in an MCP workflow?
Follow a support agent asking, "Find the last invoice for Ada Lovelace and draft a reminder."
| Step | What moves | Risk |
|---|---|---|
| 1. Prompt to model | The user's request, with the customer's name | Personal data reaches the AI provider |
| 2. Model to server (tools/call) | Arguments such as {"customer": "Ada Lovelace"} | Data sent to a server you may not control |
| 3. Server to model (result) | Invoice record: name, email, IBAN, amount | The whole record lands in the model's context |
| 4. Context to provider | Everything in steps 1 to 3 | Results are sent to the provider on the next turn |
| 5. Model to next tool | Data from earlier results | Values can be passed to a different server |
Step 3 is the one people miss. A tool result often holds far more personal data than the user typed, and it goes to the provider without anyone pasting anything.
What are the main MCP security risks?
- Untrusted servers. An MCP server is code with access to your systems. Installing one from an unknown repository is like installing any unvetted dependency.
- Over-privileged credentials. A server holding an admin token lets any tool call do admin things.
- Data exposure in results. Records returned to the model end up in the provider's context.
- Prompt injection through results. Text inside a tool result, such as an email body or a web page, can carry instructions the model follows. See prompt injection.
- Misleading tool descriptions. A server can describe its tools in ways that steer the model, sometimes called tool poisoning.
- Silent write actions. An agent that can send email or change records without approval turns a mistake into an incident.
Which controls help?
- Keep an allowlist of MCP servers and review new ones like any other dependency.
- Give each server the narrowest credentials that do the job, and separate read from write.
- Require human approval for write actions: sending, paying, deleting.
- Mask tool-call arguments and results so personal data and secrets don't flow to servers or the provider unnecessarily.
- Record metadata for every call: which server, which tool, which rule fired, without storing the content.
How does Maskflare mask MCP traffic?
- Gateway route `/v1/mcp/{server}`. Point the host at this route instead of the server. Maskflare masks
tools/callarguments before the server is called, and masks results, in JSON and SSE, before the model sees them. - Block rules return a JSON-RPC error to the host instead of forwarding the call, so the agent sees a clean failure.
- Proxy mode for MCP hosts that can't change the server URL.
- Coding-agent hooks for Claude Code, OpenAI Codex, Cursor, GitHub Copilot CLI and VS Code agent mode, installed and kept in place by the desktop agent. The hooks block prompts that contain secrets and mask shell, web, file and MCP tool input and output. See coding agents.
Maskflare also runs its own admin MCP server, so you can ask an agent about your Maskflare setup. Read tools cover devices, usage, rules, audit and a masking preview. Write tools are opt-in, and any rule change an agent makes becomes a proposal that a person approves in the console.
uvx maskflare-mcpWhat does this look like on a real request?
Back to the invoice reminder. The host calls the CRM server through /v1/mcp/crm. The model's tools/call asks for invoices for a customer. The CRM server returns a record with Ada Lovelace's name, ada@example.com, IBAN CH93 0076 2011 6238 5295 7 and an open amount of CHF 2,400. Before that result reaches the model, Maskflare replaces the name, email and IBAN with tokens. The model drafts a reminder about "the open CHF 2,400 invoice for mf_mask_170b...", and the reminder your user reviews shows the real name again. The provider saw the amount, which the model needed, and none of the identifiers, which it didn't. If a rule says IBANs must never reach any tool, the call is blocked and the agent gets a JSON-RPC error instead.
What doesn't masking solve?
Masking controls what data flows. Maskflare adds MCP access control per group (server, tool, read or write), denies destructive tools by default, handles access requests, and detects prompt injection and tool poisoning in tool descriptions and results. Scoping each server's own credentials stays with you. And a tool that legitimately needs a real value, such as an email address to send to, needs a rule exception, which is a policy decision worth making explicitly rather than by accident.
Frequently asked questions
Is MCP secure?
The protocol is a transport. How secure a setup is depends on which servers you run, what credentials they hold, what approvals you require and what data you let flow through them.
Can I mask data in MCP tool results?
Yes. Through Maskflare's /v1/mcp/{server} route, results are masked, in JSON and SSE, before the model sees them.
What happens when a tool call is blocked?
Maskflare returns a JSON-RPC error to the host instead of calling the server, so the agent gets a normal error it can handle.
Does this work with Claude Code?
Yes. Maskflare's hook for Claude Code masks MCP tool input and output, as well as Bash, WebFetch, Write and Edit, and blocks prompts containing secrets.
Can an agent change my Maskflare rules?
Only if you switch on write tools in the admin MCP server, and even then each change becomes a proposal that a person approves in the console.