Cargando el Technology Radar
Governed Model Context Protocol servers standardize how agents connect to tools, data sources, and enterprise systems while putting security controls around identity, permissions, tool descriptions, and auditability. Anthropic introduced MCP as an open standard for secure, two-way connections between data sources and AI-powered tools, with developers exposing data through MCP servers and AI applications connecting as MCP clients (Anthropic).
The governance challenge is that MCP turns integration into an agent action surface. Microsoft notes that MCP servers expose APIs, databases, files, and external systems through a client-server architecture, and warns that security risks include misconfigured authorization, OAuth token theft, over-permissioning, and tool poisoning (Microsoft Security Blog).
Keep this in Assess because MCP is becoming a practical integration standard, but the NSA warns that MCP’s security posture remains uneven and highly dependent on implementation discipline rather than protocol guarantees (NSA).
Tool poisoning is a first-class risk. Microsoft describes malicious instructions embedded in MCP tool descriptions that are invisible to users but interpreted by the AI model, potentially causing unintended actions or data exfiltration (Microsoft Security Blog).
Authentication and authorization are uneven. The NSA notes that MCP components can process data without required access controls, many implementations omit authentication entirely, and authenticated implementations often lack role-based enforcement such as separate Create, Read, Update, and Delete permissions (NSA).
Token and session handling are risky. The NSA warns that MCP implementations often rely on bearer tokens or session IDs without mandated lifecycle management for refresh, revocation, and reuse control, which can enable replay or unauthorized reuse (NSA).
Tool execution can become arbitrary code execution if user-provided logic reaches execution environments without sandboxing or validation. The NSA specifically calls out arbitrary code execution risks and CWE-77, CWE-78, CWE-94, and CWE-95 in MCP environments (NSA).
Audit gaps undermine accountability. The NSA recommends logging all tool and model invocations with parameters, identities, and result hashes where feasible, because many implementations omit logging or record only minimal metadata (NSA).
Assess MCP servers only with governance in place before adoption. Require inventory, ownership, supported versions, identity propagation, scoped OAuth or service identities, least privilege, RBAC above the protocol layer, tool-description review, parameter validation, sandboxed execution, egress controls, and complete audit logging.
Treat MCP servers as privileged integration services, not developer convenience scripts. Prefer locally governed servers for sensitive data, scan for unauthorized MCP endpoints, and route telemetry into existing SIEM and observability pipelines.