What is the Model Context Protocol (MCP)? The AI tool connection standard, defined

The Model Context Protocol (MCP) is an open protocol that standardizes how applications built on large language models connect to outside tools, data and prompt templates. A host application runs MCP clients that exchange JSON-RPC 2.0 messages with MCP servers, and each server offers resources, prompts or tools that the model can use.

Where it came from

Anthropic popularized MCP as an open source framework in November 2024, according to the NSA, and the protocol has since spread into many agent frameworks. The specification says it borrows from the Language Server Protocol, which standardized how programming languages plug into development tools.

Why it matters to a CISO

MCP is the plumbing that gives an agent its reach, so its security model decides how far a misled agent can go. The specification, revision 2026-07-28, states that tools amount to arbitrary code execution, that tool descriptions should be treated as untrusted unless they come from a trusted server, and that hosts must get explicit user consent before invoking any tool. It also concedes that the protocol cannot enforce these principles itself and leaves them to implementers.

The National Security Agency's 2026 Cybersecurity Information sheet on MCP spells out what that leaves open. Tying a session to an identity is not defined by the protocol, authorization is optional, and a server that was approved once can later gain access to sensitive resources without triggering any new review. The NSA also notes that MCP inverts the usual pattern, with servers often expected to query and act on behalf of connected clients.

The NSA's recommendations read like a checklist for a security team: keep an inventory of every deployed MCP agent and tool, sandbox tool execution, log every tool and model invocation, and scan the network for unauthenticated or unauthorized MCP servers.

Where it appears on cisonews.ai

The explainer what is the Model Context Protocol and what are its security risks covers access control, token handling and injection in full. The incident log records the Asana MCP server bug that exposed data across customers and the malicious postmark-mcp package that copied users' emails to an attacker.

Related terms

AI agent, agentic AI and prompt injection.