# WTF is an MCP server?

> Sarge says: An MCP server is not a bookmark. Know who wrote it before it touches your agent.

- Term: MCP server
- Also called: MCP; MCP servers; Model Context Protocol; tool poisoning; rug pull
- Section: AI agent threats
- Web page: https://codemarine.ai/learn/mcp-servers/

## Short version

An MCP server plugs outside tools and data into an AI agent, and those tools can do real things.

## The briefing

- **MCP:** Model Context Protocol, an open-source standard for connecting AI applications to external systems. Its docs call it a USB-C port for AI applications.
- **Server:** The program on the other end. It offers tools the AI can invoke, resources it can read and prompt templates. It can run on your machine or remotely.
- **The spec's warning:** Tools represent arbitrary code execution, and hosts must get explicit user consent before invoking one.
- **The catch:** MCP cannot enforce that at the protocol level, so it comes down to each app.
- **Local servers:** MCP security guidance says they are binaries downloaded and executed on the same machine as the client, and lists arbitrary code execution and data exfiltration among the risks.
- **Tool poisoning:** OWASP: malicious instructions hidden in tool descriptions or return values.
- **Rug pull:** OWASP: a server changing its tool definitions after you approved them.

## In the Threat Brief this looks like

> Tool poisoning in example-mcp-server 1.2.0: hidden instructions in a tool description.

You approved a tool and got its orders too. Tool text can carry prompt injection straight to your agent.

Example only. The product, versions and names are made up.

## What to do

- Know who publishes it. Installing one is closer to running a stranger's program than adding a bookmark.
- Read the exact command before you approve it.
- Do not assume a tool you approved yesterday is the same tool today.
- Treat tool descriptions and responses as untrusted. The spec and OWASP both say so.

## Official sources

- [MCP: What is the Model Context Protocol?](https://modelcontextprotocol.io/docs/getting-started/intro)
- [MCP: Specification](https://modelcontextprotocol.io/specification/2026-07-28)
- [MCP: Security Best Practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices)
- [OWASP: MCP Security Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/MCP_Security_Cheat_Sheet.html)
- [OWASP: MCP Top 10 (beta)](https://owasp.org/projects/mcp-top-10)

## Related

- [Prompt injection](https://codemarine.ai/learn/prompt-injection.md)
- [Supply chain attack](https://codemarine.ai/learn/supply-chain-attack.md)
- [RCE and privilege escalation](https://codemarine.ai/learn/rce-and-privilege-escalation.md)