MCP security testing
The Model Context Protocol (MCP) lets AI assistants and agents connect to tools and data. Each MCP server is a new way for a model to act on your systems. HYDN tests MCP servers and the clients that use them for tool poisoning, prompt injection through tool results, over-broad permissions, missing authentication, credential exposure and command injection.
What we test
- Tool poisoning. Tool names and descriptions written to manipulate the model into misusing them or other tools.
- Injection through results. Data returned by a tool that contains instructions the model then follows.
- Permissions. Whether each server can reach more files, systems or accounts than its job needs.
- Authentication and authorisation. Whether remote servers check who is calling, and whether one user can act as another.
- Credentials. API keys and tokens held by servers, how they are stored, and whether they can leak through tool output.
- Command and code execution. Servers that pass model-chosen input to shells, interpreters or queries.
- Client configuration. Auto-approval settings that let the model call sensitive tools without a human confirming.
Where MCP shows up
MCP servers now sit behind coding assistants, internal agents and customer-facing AI features, often installed by developers without a security review. If you are not sure which servers are in use across your organisation, start with AI discovery.
Frequently asked questions
What is MCP?
An open protocol, introduced by Anthropic in November 2024, that standardises how AI applications connect to external tools and data sources. A server exposes tools and resources; a client, such as a coding assistant or agent, lets the model call them.
We only use third-party MCP servers. Is there anything to test?
Yes. What each server can reach, which credentials it holds, how your clients are configured, and whether tool descriptions or results from those servers can steer your models.
Published Updated