There is a running joke that 'The “S” in MCP Stands for Security', but is that reasonable? What threats exist? What layers do they operate on? How can you safely host MCP servers in production? Can you connect to MCPs in sensitive environments? Drawing from lessons learned at GitHub and beyond, this interactive discussion will explore the practical realities of MCP security today, examining real exploits and vulnerabilities that have emerged, what mitigations are effective and how the spec/ecosystem might evolve to better address these risks.
The threat landscape touches every layer. Server authors face supply chain risks, tool poisoning, and building integrations that are frequent targets for attempted exploits. Client and host developers need to handle authentication, consent, session integrity, and permission scoping across tools they don't control. Gateway and registry operators are trying to establish trust signals for servers that may be well-intentioned but poorly built, or actively malicious. And all of this sits on top of a fundamental reality: models may follow instructions from any content they process, regardless of where it came from.
In this workshop, we will:
- Walk through real attack scenarios, including cross-repository data exfiltration and the class of vulnerabilities Simon Willison describes as the "lethal trifecta"
- Break down the threat model across MCP servers, clients, and gateways: prompt injection, session hijacking, tool poisoning, credential handling, over-permissioned tokens and more.
- Examine what guardrails exist today in the spec and in practice, what they actually protect against, and where significant gaps remain
- Dig into the question of untrusted servers: what would it take to safely run an MCP server you don't fully trust, and whether that's a realistic goal
- Open the floor to the room. Bring your own threat scenarios, architectural concerns, and hard-won lessons. This is a facilitated discussion, not a lecture
You'll leave with a concrete understanding of the current MCP threat landscape, practical approaches to reducing risk at each layer, and a realistic sense of what problems remain unsolved. Whether you're building servers, integrating MCP into a product, or evaluating it for your organization, this session will help you invest your security effort where it counts.
