MCP: Untrusted Servers and Confused Clients, Plus a Sneaky Exploit
Brief
The Model Context Protocol (MCP) is a protocol definition for how LLM apps/agents can leverage external tools. I have been calling it Model Control Protocol at times, because due to prompt injection, MCP tool servers control the client basically.
This post will explain in detail why that is, and I will also share a novel exploit chain.
Why MCP - How Is It Different?
The main difference to other tool invocation setups, like OpenAPI is that MCP is dynamic. It allows runtime discovery of available tools, etc from a given server. At the core it supports three capabilities: tools , resources , and prompts .