MCP Becomes a New Attack Surface: Controlling Servers, Skills, and Tool Calls

⚡ The gist in 5 seconds - Infera Security has published an analysis of MCP as a new attack surface on workstations. - The article's thesis: you need to control not only prompts, but also MCP servers, skills, and tool calls. - The key risk condition: an AI agent runs with local user privileges and gets access to email, SharePoint, files, and command execution. ### 🔍 What was found Habr has published an analysis by Infera Security that treats MCP (Model Context Protocol) as a new attack surface. The starting point is a threat model for an AI agent running directly on a workstation: it operates with local user privileges and can therefore read email, access SharePoint, work with files, run commands, and invoke tools. According to the article's logic, security focused solely on prompts leaves these channels outside the control perimeter. The mechanics the author points to: the agent has not only text input, but also a set of connected MCP servers, skills, and the tool calls themselves. The article proposes bringing these three levels under control — that is, managing which servers are connected, which skills are available to the agent, and which tool calls it is allowed to execute, rather than limiting security to filtering input prompts. ### 💡 Why it matters The practical problem is that an agent with local user privileges has a blast radius identical to the employee's own permissions: email, SharePoint, files, and the command line are all in one access zone. If security is built around prompts alone while connected MCP servers, skills, and tool calls remain uncontrolled, the attack surface is wider than commonly assumed. The analysis is a proposal to rebuild the security model for agentic scenarios, where the decision to invoke a tool needs to be authorized separately from the request text.