MCP security
Know every MCP tool.Decide every call to it.
The Model Context Protocol lets an agent discover tools at runtime from any server it can reach. That is the point, and it is the risk: a tool listing can change, a server can be impersonated and a poisoned description can steer the model. Trustivan lists each server's tools, records the server as a resource and each tool's publisher-declared effect, and never calls a tool or reads a server's resources or prompts.
AvailableMCP connector (tools/list) · not yet run against a live server
- mcp://ticketsHTTPSauth: bearer7 tools4 read · 2 write · 1 unknownunchanged · synced 2h agoHealthy3 agents entitled
- mcp://docs-searchHTTPSauth: bearer4 tools4 readunchanged · synced 2h agoHealthy5 agents entitled
- mcp://warehouseHTTPSauth: bearer9 tools3 read · 3 write · 3 unknown2 tools first seen this weekReview2 agents entitled
- mcp://build-toolsHTTPSauth: none0 toolsno tools listedno tools capability declaredDegraded0 agents entitled
What MCP changes
A protocol for discovering capabilities is a protocol for acquiring authority.
MCP makes tools portable across agents and frameworks. It also moves the moment an agent gains a capability from deploy time to runtime, where no review was ever scheduled.
Discovery At Runtime
An agent learns which tools exist by asking the server, so its capabilities are whatever the server says today
Listings That Drift
A tool's name can stay the same while its description, schema or behaviour changes underneath it
Servers Without Auth
Local stdio servers on developer machines have no auth flow at all; whoever can start them is trusted
Coverage
What Trustivan reads from MCP
The MCP connector lists what a server offers and records each tool's declared effect. Which agents may call a tool is declared by an operator, because a server does not know its callers.
Servers and tool listings
Each sync calls initialize and tools/list over HTTPS, records the server as a resource and every tool it lists, and takes each tool's effect from its readOnlyHint, or records it as unknown. An operator can override an effect and declare which agents may call which tool. Two new tools on a warehouse server become visible on the next sync, with no effect assumed from their names.
- Server: the operator's name for it and its HTTPS endpoint; private and loopback addresses are refused.
- Tools: name and publisher-declared effect (read, write or unknown), marked absent when delisted.
- Never: tools/call, MCP resources or prompts, or any claim about which agents call a tool.
AvailableModel Context Protocol connector
View the integration catalogueTool listings · mcp://warehouse, mcp://build-tools
6 tools · 2 first seen this week · 2 with no declared effect
- warehouse.querymcp://warehouse · first seen 41d agoReadPublisherEntitled
- warehouse.export_tablemcp://warehouse · first seen 41d agoWritePublisherEntitled
- warehouse.grant_rolemcp://warehouse · first seen 2d agoAdminOperatorNot entitled
- warehouse.drop_tablemcp://warehouse · first seen 2d agoWriteOperatorNot entitled
- fs.read_anymcp://build-tools · first seen 5d agoUnknownNoneEntitled
- shell.execmcp://build-tools · first seen 5d agoUnknownNoneNot entitled
Illustrative · sample environment
Illustrative tool listings from two servers · effect basis and entitlement per tool
Threats
Four ways an MCP server becomes an attack path
Each is addressed by treating a tool as authority an operator grants and a gate decides, not as text the model should be careful about.
OWASP agentic threats, mappedTool Poisoning
A description carries instructions, or a server changes a tool after approval. A tool's effect comes from the publisher's hint or an operator's declaration, never its description, and a tool with no declared effect is challenged
Tool Impersonation
A server mimics a trusted one by name. Tools are keyed to the operator's name for the server, not the name the server gives itself, and a call to a tool never discovered is denied
Rogue And Unsanctioned Servers
A server nobody reviewed is reachable by agents holding real credentials. A call to a tool outside an agent's declared entitlements is denied at the gate
Cross-Server Confused Deputy
A low-trust server's tool output steers an agent into calling a high-trust server. The second call is decided on the credential, the tool's entitlement and effect and the resource's impact; its stated purpose is recorded, never evaluated
Trust boundaries
Three answers, decided per call
Trust in an MCP tool is not a label on the server. It is the entitlement an operator declared, the effect the tool carries and the decision the gate records for every call.
Entitled
An operator declared that this agent may call the tool, and its effect is declared. The call is decided on the resource's impact and the agent's autonomy, and recorded
Undeclared
Nobody has declared what the tool does, or this agent's entitlements were never declared. A mutating call returns CHALLENGE until someone does
Not Entitled
The agent's entitlements are declared and this tool is not among them, or the tool was never discovered. The call returns DENY
What you get
MCP governance with the evidence attached
Every server entry lists its tools, their declared effect and the agents an operator entitled to call them.
MCP Tool Inventory
Every tool each server lists, recorded against the server, with when it was first discovered and whether it is still listed
Publisher-Declared Effect
Read, write or unknown from the tool's readOnlyHint, kept with its basis so a finding never overstates it
Operator Effect Overrides
A declaration that outranks every later sync, for the security engineer who disbelieves a server
Declared Entitlements
Which agent may call which tool, declared by an operator and enforced at the runtime gate
Degraded Servers Reported
A server that answers but declares no tools is degraded, never a green tick over an empty catalogue
A Decision For Every Call
Every ALLOW, CHALLENGE and DENY for a call to an MCP tool, recorded immutably with the rules that fired