As organizations experiment with Model Context Protocol (MCP) servers to expose LLMs to their file systems, APIs, and other real-world resources, it becomes critical to understand the new threat landscape. MCP servers expose collections of tools that agents can invoke to act on behalf of the user. This new flexibility comes with new threats: if an MCP server is compromised, an attacker can trick the model into executing malicious commands, exfiltrating secrets, or corrupting data. This post breaks down the MCP threat landscape, highlights relevant OWASP recommendations, examines Boomi’s MCP risk-scoring features, and explains how an AI agent can help security teams evaluate tools at scale.
Understanding the agentic attack landscape
Attackers exploit the unique characteristics of MCP servers. Four classes of threats stand out:
Tool poisoning and rug pulls
When users connect with third-party tools, attackers can modify tool metadata or parameters so the description hides a dangerous operation. For example, a benign-looking tool may include hidden instructions telling the model to ignore safety policies. In a rug pull, the tool behaves correctly during initial use but later updates to execute malicious code. These attacks erode trust because the model cannot easily distinguish between legitimate and tampered tools.
Prompt injection
MCP agents interpret natural language, so adversaries hide malicious instructions in untrusted context. If tool descriptions or retrieved documents contain strings like “ignore previous instructions,” the model may bypass safety rules and leak secrets.
Memory poisoning and context manipulation
MCP servers maintain working memory to store prompts, retrievals, and intermediate outputs. Attackers can tamper with memory pointers or inject malicious context, causing the agent to operate on false data or leak sensitive information. Such tampering can lead to context corruption and system compromise.
Cross-server tool interference
When multiple MCP servers are available, outputs from one may trigger tools on another. Without validation, this chain reaction can lead to uncontrolled behavior. OWASP’s cheat sheet warns that untrusted servers should be treated like external vendors: isolate execution contexts, apply timeouts, and require human approval for sensitive actions.
Mitigation frameworks and governance
OWASP advocates for a rigorous governance framework to tame MCP’s complexity. Key practices include:
- Registry-based discovery: maintain an internal registry of approved servers rather than discovering them dynamically. Registries ensure origin verification, version consistency, and signed manifests.
- Version pinning and hashing: pin each tool and schema to a specific version and cryptographic hash so any drift triggers an alert.
- Least-privilege access: separate read-only and write-capable tools; require human approval for first-time or high-impact actions.
- Sandboxing and isolation: run untrusted servers in containers, restrict network egress, and block direct access to sensitive systems.
- Continuous monitoring: collect telemetry on tool invocations and context changes and keep immutable audit trails.
These practices form the baseline for any MCP deployment.
Boomi MCP Gateway: AI-driven risk scoring and governance
Boomi MCP Gateway operationalizes OWASP’s mitigation recommendations by providing an automated risk-scoring engine and governance workflow. Administrators use MCPX to build a trusted internal catalog of servers that is continuously updated and monitored. The platform evaluates each server using multiple factors:
- Version drift detection: MCP Gateway scans server manifests and schemas to detect drift from expected versions. Unexpected changes could indicate a rug pull or dependency tampering.
- Tool description analysis: Leveraging a large language model, MCP Gateway reviews tool descriptions to spot malicious or ambiguous instructions. Phrases like “ignore previous instructions” or requests for privileged operations raise a server’s risk score.
- Sensitive tool classification: The platform classifies tools as read or write/execute. Write-capable tools, such as functions that modify data or run code, are classified as higher risk because they can cause side effects.
- Authentication and authorization review: MCP Gateway checks whether the server enforces modern authentication (OAuth, OIDC) and ensures tokens are scoped and short-lived.
- Context minimization: Drawing on OWASP and industry best practices, the platform assesses whether the server supports limiting context size, separating sessions, and enforcing memory time-to-live settings. Large or persistent context increases the risk of memory poisoning and prompt injection.
These metrics combine into a composite risk score, visualized in the MCP Gateway Admin dashboard. Administrators can run sandbox analyses, unlock versions, or scan dependencies directly from this screen. After scanning, MCP Gateway places servers into one of three buckets: Trusted (low risk with strong provenance), Review required (medium risk due to missing auth or ambiguous descriptions), or Blocked (high risk with malicious indicators).
AI-driven analysis with MCP Gateway
Manual review of tool definitions does not scale, so Boomi integrated a large language model into MCP Gateway. This is the core of Boomi’s risk-scoring approach. MCP Gateway is configured via a system prompt to audit tool definitions and feeds its findings directly into the scoring engine. It analyzes tool names, descriptions, and input schemas using a security-first, least-privilege mindset. MCP Gateway evaluates each tool along three dimensions:
- OWASP alignment: The agent cross-references the tool’s capabilities with OWASP categories such as insecure output handling, sensitive information disclosure, and excessive agency.
- Malicious intent detection: It scans descriptions and arguments for prompt injection patterns or strings that attempt to override instructions; any such attempt is marked as critical.
- Parameter scoping and risk reduction: For high-impact tools, the agent proposes constraints (for example, restricting a file deletion tool to a /tmp directory) to lower residual risk.
Risk classification rubric
MCP Gateway assigns tools to four tiers based on their potential impact:
- Critical: arbitrary code execution, file deletion outside a sandbox, or confirmed malicious prompts.
- High: write access to business-critical data, network calls to arbitrary URLs, or access to personally identifiable information.
- Medium: read-only access to internal data or low-impact write operations, such as creating a calendar event.
- Low: read-only access to public data or pure computations with no side effects.
Structured reporting and dashboards
For each tool, MCP Gateway produces a structured report detailing its capability, the relevant OWASP concerns, detected injections, proposed input constraints, and residual risk. MCP Gateway ingests these reports so administrators can configure policies (for example, disable a tool, restrict parameters, or require human approval) and observe how the dynamic server risk changes.
The Tools & Hardening tab lists individual tools with risk labels and daily invocation counts. Read-only functions like read_query are classified as low risk, while destructive operations such as drop_table are flagged as critical. On this page, administrators can configure policies to remove access to high-risk tools, immediately lowering the risk score of the server.
Connecting agents to real, production environments through MCP servers unlocks powerful new capabilities, but it also creates novel attack opportunities. OWASP’s research underscores that insecure output handling, sensitive information disclosure, and excessive agency are serious risks that can lead to code execution, data leaks, and compromised autonomy.
Effective protection requires governance controls such as version pinning, least privilege, sandboxing, and continuous monitoring. Boomi’s MCP Gateway automates these best practices by scoring servers across multiple factors and providing a clear workflow for approval, review, or blocking. MCP Gateway uses OWASP-aligned analysis to detect malicious prompts, suggest constraints, and classify tool risk, helping organizations build a secure internal catalog and put agentic AI to work safely.
To see how Boomi helps you secure MCP servers and agent toolchains at scale, get our Guide to Securing the Agentic Enterprise.