With AI innovations shifting toward Agentic AI, a crucial component of the AI agentic workflow is the tools and systems to enable AI to search for information or take actions on behalf of the user. One way of doing so is through the Model Context Protocol (MCP). However, as with any new technology, there are security vulnerabilities and potential exploits that an enterprise must consider while implementing its MCP adoption strategy. In drawing from the experience at Nutrient, this article will discuss the lessons learned when adopting MCP technology as an enterprise.
Get started with enterprise-ready MCP servers for advanced PDF processing. Try the Document Web Service (DWS) Processor API or the Document Engine today.
You can certainly read up on the official documentation(opens in a new tab) for MCP, but for the purpose of this article, MCP is a standard on how to allow LLMs to take actions. Action here can mean many things — for example:
There are two parts to an MCP protocol: the MCP client and the MCP server.
MCP client
To take the analogy of a restaurant, the LLM is your waiter who takes your request and creates an order. The lightweight program is the iPad the waiter uses to send your order to the kitchen (the MCP server). And sometimes the waiter comes with the menu to tell you which dish is available.
MCP server
Going back to the restaurant analogy, the MCP server is the kitchen that takes in the order from the waiter (the MCP client) and sends back the food. The kitchen is also responsible for telling the waiter beforehand which dish is on the menu. Optionally, the kitchen can update the waiter about which dishes are out or newly available.
Most of the security risks with MCP come from the MCP server. This is because it’s the MCP server that actually performs operations, whereas the MCP client merely calls the LLMs and handles the communication. For companies looking to use MCP servers or to build and offer MCP servers to their customers, there are different sets of considerations for each use case.
When you’re using MCP servers, it’s crucial to verify and vet MCP servers that come from a trusted source. Treat an MCP server like a piece of software you install on your computer, because a malicious MCP server can do as much damage as malware. Here are a few ways to find trustable MCP servers.
Some SaaS companies provide their users with official MCP servers. Examples include:
There are also registries that list official integrations, such as the official Model Context Protocol GitHub repository(opens in a new tab).
One drawback with official first-party supported MCP servers is that most of them are MCP servers exposing the API of the first-party services. For example, the GitHub MCP server(opens in a new tab) allows an LLM to take actions similar to those that can be achieved via the GitHub API. However, if you’re interested in “utilities” — such as file system(opens in a new tab) or internet access(opens in a new tab) — you’ll have to look to open source projects. To make sure open source MCP servers are suitable for enterprise use cases, we recommend:
If you’re instead interested in creating MCP servers to offer to your customers, here are a few considerations to create a secure MCP server.
Given how powerful LLMs are, you might be tempted to give the AI even more controls over the MCP tools. However, we recommend avoiding these types of tools in your MCP servers:
While not supported by most MCP clients like Claude Desktop, the MCP server can leverage the elicitation(opens in a new tab) feature to get the user’s confirmation before executing sensitive tools.
The MCP protocol supports two methods of transporting messages between client and server: Standard IO (stdio) and Streamable HTTP. Unless your use case requires using Streamable HTTP transport, such as creating a remote MCP server or managing multiple sessions, it’s recommended to run your MCP server using the stdio transport to reduce the risk of network attacks(opens in a new tab).
And most importantly, MCP developers should keep up to date on the most recent security considerations from the official MCP documentation(opens in a new tab). This page contains vulnerabilities and mitigation strategies that are not discussed in this article such as DNS rebinding attacks and session hijacking.
At Nutrient, we’re adopting MCP in the solutions we offer to customers, our open source contributions, and our internal tooling. Here are a few highlights:
Take advantage of our open source MCP server to explore and analyze PDF structures efficiently.
此内容由惯性聚合(RSS阅读器)自动聚合整理，仅供阅读参考。 原文来自 — 版权归原作者所有。