Model Context Protocol (MCP)

Model Context Protocol (MCP) is designed to securely connect Artificial Intelligence (AI) models, particularly Large Language Models (LLMs), to external data sources, enterprise tools and runtime environments.

What is Model Context Protocol?

The Model Context Protocol (MCP) is an open, standardized framework that defines how AI models securely ingest context, execute tools and interact with the data layer of an enterprise architecture. Originally introduced to address fragmentation in bespoke LLM integrations, MCP establishes a uniform client-server architecture.

In this architecture, developers expose data or services via an MCP Server, and AI applications (acting as MCP Clients) safely query these resources. Rather than creating a unique API wrapper for every data repository, database or software development tool, an organization can leverage MCP to provide a secure, bidirectional abstraction layer. This layer gives AI agents regulated, real-time access to the specific context they need to execute tasks accurately and safely.

Why is Model Context Protocol (MCP) important in a runtime context?

In modern production environments, AI models are no longer static, isolated systems; they are active components embedded within runtime codebases and application flows. When an LLM interacts with production data or triggers live enterprise actions, it introduces unprecedented security vectors collectively known as AI runtime vulnerabilities.

Traditional Application Security (AppSec) tools are blind to the execution context of an LLM. MCP provides a structured boundary where security teams can observe, throttle and audit exactly what context is fed into a model and what actions the model requests in return. Without a standardized protocol like MCP operating at runtime, organizations risk critical failures such as:

• Prompt injection escalation: An attacker manipulating an LLM to abuse its connected tools.
• Data leakage: The AI pulling sensitive, unauthorized production data into its context window.
• Unbounded execution: AI agents initiating rogue operations or state changes within live systems.

By formalizing these interactions at runtime, security teams can apply deterministic access controls and continuous monitoring to non-deterministic AI behaviors.

How does Model Context Protocol (MCP) work?

MCP operates fundamentally as a client-server architecture implemented over standard transport layers (such as JSON-RPC 2.0 over SSE or standard input/output).

The protocol breaks down capabilities into three primary primitive types:

1. Prompts: Standardized templates provided by the server that the client can use to structure user interactions safely.
2. Resources: Read-only data sources exposed by the server. This allows the client to supply raw file contents, database schemas, or system logs directly into the LLM’s context window.
3. Tools: Executable actions that the LLM can discover and invoke. When the model determines it needs to perform an action (e.g., fetching a ticket or modifying a file), it issues a call to the MCP server, which executes the code locally and returns the result.

During runtime execution, the MCP client mediates between the LLM and the MCP server. When a user interacts with the AI, the client queries the server for available tools and resources, informs the LLM of these capabilities, and securely coordinates the exchange of data payloads.

Model Context Protocol (MCP) vs. Retrieval-Augmented Generation (RAG)

While both concepts address the core challenge of providing external data to an AI model, they operate at completely different layers of the architectural stack.

Consequences and risks of Model Context Protocol (MCP)

While MCP drastically simplifies AI integrations, deploying it in production without robust application security introduces severe risks:

• Over-privileged tool access: If an MCP server exposes tools with broad write or delete permissions, an attacker using indirect prompt injection (embedding malicious instructions in data read by the AI) can force the LLM to execute destructive tool commands.
• Context poisoning: If an MCP resource pulls data from an untrusted external source, that data can hijack the model's instructions mid-session, pivoting the AI into an adversarial state.
• Session invalidation and insecure context windows: As massive amounts of enterprise data are streamed into the context window via MCP resources, sensitive regulatory data (PII, PHI) may be processed or cached insecurely in downstream AI infrastructure.

How to prevent/mitigate MCP vulnerabilities

Securing the Model Context Protocol (MCP) requires a zero-trust approach to AI tool and resource access at the runtime layer:

• Enforce strict input validation at the server boundary: Never trust the arguments generated by an LLM for tool execution. Treat tool parameters exactly like unvalidated user input.
• Implement Human-in-the-Loop (HITL) for destructive actions: Require explicit human authorization before executing any MCP tool that performs a state change, deletes data or sends a cross-domain notification.
• Apply least-privilege access to MCP servers: Ensure that the MCP server's underlying runtime execution context has minimal OS and network permissions.
• Continuous auditing of the context stream: Monitor the payloads flowing across MCP clients and servers to detect anomalous behavior, anomalous payload sizing, or attempts to inject system instructions.

How Contrast Security helps with Model Context Protocol (MCP)

As organizations embed AI agents into their core business logic using protocols like MCP, ensuring the integrity of the underlying application runtime becomes paramount. Contrast Security protects your AI-driven ecosystem through a dual-lens approach to runtime protection.

Application Detection and Response (ADR)

Contrast’s Application Detection and Response (ADR) monitors your application behavior from the inside out while it runs. ADR maps data flows as they pass between your application, user inputs and your MCP-connected LLMs. If an indirect prompt injection attack attempts to force an MCP tool to execute a malicious system exploit or access an unauthorized database route at runtime, Contrast detects the anomalous behavior and immediately intercepts the threat, defending your live enterprise application.