MCP Security

Ziva Wernick did a Google AI workshop today and learned about MCP. She raised valuable concerns about MCP security and privacy.

1. Security: Has to do with the security risk of using MCP servers, and the possibility of those servers to facilitate malicious actions.
2. Privacy: Has to do with AI tools constantly collecting private information. In some cases there may be an option to opt-out, or pay for an enterprise license that limits what the provider can do with the data.

I will focus on Security in regards to how it works with agentic CLI tools and MCP servers.

MCP Horror Stories

Docker Blog wrote a series called MCP Horror Stories:

1. Part 1: MCP Security Issues Threatening AI Infrastructure | Docker
2. Part 2: MCP Horror Stories: The Supply Chain Attack | Docker
3. Part 3: The GitHub Prompt Injection Data Heist | Docker
4. Part 4: MCP Horror Stories: The Drive-By Localhost Breach | Docker

Unrelated to Docker, there’s also this article that features “Five Horror Stories That Actually Happened”: The Day I Told 800+ Engineers Their AI Dreams Could Become Security Nightmares

First Malicious MCP in the Wild

On 2025-09-25, Koi Blog wrote this article: First Malicious MCP in the Wild: The Postmark Backdoor That’s Stealing Your Emails | Koi Blog

The article generated some discussion, including on Hacker News: A Postmark backdoor that’s downloading emails | Hacker News. Some of the comments pointed out that the MCP risk isn’t really different from existing software risks:

Are MCP Security risks real or overblown?

MCP security risks are a real concern and I do not want to downplay that. In many ways though, these risks have existed for as long as software itself, MCP is just the latest attack vendor.

I will note that the blogs I featured here, from Docker and Koi Security, are from companies that attempt to sell solutions to this problem. This does not mean that the problem is not real or that the solutions are not needed, just something to note. I actually do find Docker’s MCP solutions to be very interesting (I mention Docker MCP Catalog below in Supply-Chain Security).

MCP Defense

The article “The Day I Told 800+ Engineers Their AI Dreams Could Become Security Nightmares” (mentioned above in MCP Horror Stories), suggests five defense solutions:

What I Do

So far I have been limiting my MCP usage to personal projects and learning. Below are some of the things I have noted while learning about how to use MCP “safely”:

Supply-Chain Security

When Ziva asked about the MCP security risks, she was told to “read the code”. While it’s true that many MCP servers are open-source, reviewing all of them is not exactly feasible. I often do a surface level look at the repo, its activity and amount of stars, but this is not same as reviewing the code in-depth. For this reason, I believe it is worth using MCP servers by known publishers. Docker does come in handy here with their Docker MCP Catalog. While, this catalog is not as extensive as other MCP galleries, it focuses on quality over quantity. All of the MCP servers are in the Docker MCP Catalog are by known publishers. Note that I still refuse to use Docker Desktop (due to its license), but these MCP servers can also be used in Docker CLI together with an MCP client.

MCP Server Configuration

Some MCP servers may have permissive default permissions, but can be configured to be more “locked-down” and limited and what they can do and access.

As an example, Kubernetes MCP Server can be run in read-only mode (this is not the default but can be set with a flag when setting up the MCP server). In this mode, the Kubernetes MCP server cannot make changes to clusters (for example, it is unable to apply manifests, but can still view existing resources). Note that even in this mode there can be security risks. One example is viewing secrets. In Kubernetes, secrets are stored in Base64 strings, which are trivial to decode for anyone that has full read access to the cluster. I have personally witnessed Claude Code attempt to read and decode Kuberenets Secrets (either with Kubernetes MCP Server or just kubectl commands) when asked to help troubleshoot my homelab cluster. For this reason, when using agentic CLI tools, I prefer to approve each command individually. Further, Kubernetes access can be regulated with Role-based access control (RBAC).

Ignore files

Similar to .gitignore files, most agentic CLI tools have a way to exclude specific files from the context. For example, a .env file (that may include secrets), should be specifically excluded (when not doing this, I have seen Claude Code attempt to read these files). Unfortunately, there isn’t really a standard “ignore file” for this, each tool has it own way to achieve this. If using multiple tools, multiple files might be needed.

Documentation on excluding/ignoring files

• Exclude files from Gemini Code Assist use  |  Google for Developers
• Claude Code settings - Claude Docs
• Ignore files | Cursor Docs
• Excluding content from GitHub Copilot - GitHub Docs
• charmbracelet/crush: The glamourous AI coding agent for your favourite terminal 💘
• Config | OpenCode

Featured image by FlyD on Unsplash.