The Protocol Behind the Curtain: What MCP Really Exposes

The talk opens with why the Model Context Protocol matters: it lets AI agents discover and call external tools and services, but its design rests on assumptions that often fail in practice. The speakers walk through the host, client and server components and the stages where a server is set up, used and updated. They cite third-party research suggesting that many public servers allow command injection or can be pushed into fetching arbitrary URLs.

Attacks are demonstrated at each stage. Tool poisoning hides instructions in tool descriptions, and the line jumping variant uses one malicious server to steer calls made to a separate, benign server within the same host. Tool squatting imitates a trusted server name. Version drift shows that a server can change its tools after approval with no notification to the user. An indirect injection demo has an agent fetch a forum post that tells it to read local configuration files. The speakers then present Drift Cop, a GitHub-hosted tool that fingerprints tool definitions, flags risk changes and requires human approval before they are accepted.

The closing advice is to vet servers, disable unused ones and monitor tool-call activity. Data from public sources should never be allowed to reach private resources, and least privilege should apply to every tool. The Q&A touched on authentication support and detection rules that chain outbound calls with local file access, while platform-level defenses against injection were acknowledged as unresolved.