MCP Servers: A Hidden Gap in Enterprise Security
MCP servers can expose enterprise secrets through plaintext configuration files, over-permissioned access, and prompt injection, highlighting the need for robust security measures to protect sensitive data.
The increasing adoption of AI agents in enterprise systems has introduced a new layer of security risks, particularly with the use of Model Context Protocol (MCP) servers. These servers, which enable AI agents to connect to external tools and data, can inadvertently expose sensitive information, including credentials, service account keys, and API tokens.
## What is Model Context Protocol (MCP)?
MCP is an open standard that allows AI assistants to connect to external tools and data, enabling them to retrieve records from databases, open files, or call APIs. The MCP server acts as a middleman, exposing specific actions that the AI agent is allowed to perform, but this also creates a significant risk, as the server requires the system's credentials to function.
## Ways MCP servers may expose secrets
The convenience of MCP comes with a catch: the server that allows an AI agent to perform meaningful work is also a hub for credentials. Many MCP servers are built and deployed without adequate security measures, leaving them vulnerable to attacks. Some common ways secrets can be exposed in MCP servers include plaintext credentials in config files, credential sprawl across ungoverned servers, prompt injection, over-permissioning, and exposed-server risk.
## How to secure enterprise secrets on MCP servers
To mitigate these risks, organizations can implement several best practices, including stopping hardcoding secrets and centralizing them, using short-lived credentials and rotating them automatically, enforcing least privilege, keeping a human in the loop for sensitive actions, encrypting secrets with a zero-trust, zero-knowledge model, logging and auditing everything the agent does, and inventorying MCP servers. By applying these measures, organizations can protect their sensitive data and prevent potential breaches.
| **Best Practice** | **Description** | | --- | --- | | Centralize secrets | Pull credentials out of config files and environment variables and place them into a single managed store | | Use short-lived credentials | Replace static secrets with credentials issued on demand and expiring on their own | | Enforce least privilege | Give each AI agent access only to the systems and data its task requires | | Keep a human in the loop | Require explicit confirmation for sensitive actions | | Encrypt secrets | Use end-to-end encryption and a zero-knowledge approach to protect secrets | | Log and audit | Maintain a full record of what was accessed and when | | Inventory MCP servers | Maintain visibility into every MCP server running in the environment |
