The Model Context Protocol: Convenience meets vulnerability

The talk introduces the Model Context Protocol, which lets AI clients connect to external tools, data resources and prompt templates through MCP servers. The speaker walks through the client-server handshake, the tool listing and tool call flow, and the server-to-client features of sampling, elicitation and logging, explaining why these connections widen what an AI assistant can reach.

The middle section covers three areas of risk. Tool poisoning hides malicious instructions in tool descriptions that the model reads but users do not see, and the speaker cites tests in which clients followed such hidden directions without asking for approval. Authorization problems arise when an MCP server acts as both resource server and authorization server under the earlier specification, which fragments discovery endpoints and complicates enterprise identity integration. Rug pulls occur when a tool that was approved later changes its description or behavior silently. The speaker notes that new MCP issues appear so frequently that a complete catalogue was impractical.

The closing part gives practical advice: treat untrusted servers with caution, review tool descriptions before they reach the model, scan and sanitise descriptions, apply trust on first use with alerts on change, disable unused servers, and keep a human approving sensitive actions. The speaker proposes separating the identity provider from MCP resource servers, and invites the community to help build a deliberately vulnerable MCP test project.