Where the risk really is: client, server, agent, permissions and integrations

Introduction

When people talk about “MCP risk”, it is easy to attribute to the protocol problems that belong to a specific server, client or integration. A useful evaluation distinguishes those components and follows the path of data and authority in each call.

Five boundaries worth mapping

Client and host application. The client configures connections and may mediate calls, approval and display. Review how it presents tools, what information it shows before an action and how it handles errors and sessions.

Model or agent. The model interprets requests and results, but it must not be treated as an infallible authorization boundary. It can receive misleading content or request inappropriate operations. The client and the services must apply deterministic controls outside the model.

MCP server and tools. The server may expose operations with different consequences. Inventory its capabilities, validate its implementation and give each tool only the permissions it needs.

Credentials and permissions. Identify who grants each credential, which resource it gives access to and who can invoke it. A token available in the process should not automatically become unrestricted permission for any call.

Integrations and external content. APIs, repositories, files, search results and documents can return untrusted data. That data can be relevant to a task and, at the same time, contain instructions that must not be raised to authority.

Analysis by flow, not by label

For a specific task, record input, transformations, model decisions, call, server validation, external service and response. Mark where identity could change, consent could be lost or information could cross between users. A local connection does not mean all of its data is local: the server could communicate with other systems.

Conclusion

MCP is not intrinsically vulnerable because it connects components. The risk depends on trust boundaries, the capabilities granted and the controls implemented on each leg. Evaluating the whole flow avoids both alarmism and blind spots.