Adding an MCP Server is Installing Software with Your Agent’s Privileges

When you install an MCP server, you're (hopefully) performing the privilege review upon install. Since you can see the tool list and descriptions, you can assess the risk that it poses and look for potential malicious functionality.

The problem is that these tool lists and descriptions are self-reported and can change at any time. Installing them with your agent's permissions is more like installing software with silent, automatic updates.

MCP Servers are a Supply Chain Risk

MCP servers run as software with whatever credentials you give them, and an agent's access includes anything that its tools can reach. Additionally, AI agents may share potentially sensitive data with the tools that they call.

Since MCP server tool lists, descriptions, and code can be updated at any time, this practice introduces a significant supply chain risk. Attackers can (and have) introduced malicious updates to MCP servers that put users at risk. For example, postmark-mcp masqueraded as a legitimate server for 15 clean versions until one of its tools introduced a BCC to the attacker in version v1.0.16.

Alternatively, the tool lists displayed during the approval stage can be malicious. Since tool lists are included in the context of the AI model, injection attacks can impact the behavior of the model, potentially with cascading effects.

Approval is a Snapshot

Reviewing the tool lists and descriptions of an MCP server upon install is important for security. However, the mutable nature of these systems means that it's not enough.

If approval for an MCP server is tied to the name, later updates slip through the cracks, and Cursor did exactly that (CVE-2025-54136). While Cursor 1.3 (July 2025) introduced the requirement for reapproval when an entry is modified, the MCP rules only say that servers "should" send notifications of a change to the list.

Managing the Supply Chain Risks of MCP

MCP servers can be useful tools, but they need to be treated more like software dependencies than static applications. Best practices for managing their security risks include:

• Pin and hash package and tool definitions to make changes detectable
• Log list_changed events and tool calls to compare to reported capabilities
• Don't give one agent access to private data, external channels, and untrusted content at the same time
• Use scoped credentials and sandboxing to limit the risk of a compromised agent

Agentic AI is already dangerous, and since human review has limited effects, these controls need to work without it. Introducing MCP servers into the mix exacerbates these issues.

Educational content, not legal, financial, investment, or professional security advice. Terms