How enterprises can adopt Model Context Protocol safely
Table of contents
With AI innovations shifting toward Agentic AI, a crucial component of the AI agentic workflow is the tools and systems to enable AI to search for information or take actions on behalf of the user. One way of doing so is through the Model Context Protocol (MCP). However, as with any new technology, there are security vulnerabilities and potential exploits that an enterprise must consider while implementing its MCP adoption strategy. In drawing from the experience at Nutrient, this article will discuss the lessons learned when adopting MCP technology as an enterprise.
Get started with enterprise-ready MCP servers for advanced PDF processing. Try the Document Web Service (DWS) Processor API or the Document Engine today.
What is Model Context Protocol?
You can certainly read up on the official documentation(opens in a new tab) for MCP, but for the purpose of this article, MCP is a standard on how to allow LLMs to take actions. Action here can mean many things — for example:
- Fetching information from an URL
- Running a search query on a database
- Sending an email
- Modifying files
There are two parts to an MCP protocol: the MCP client and the MCP server.
MCP client
- Contains an LLM that takes in a user’s request and decides to make function calls based on the MCP protocol.
- Contains a lightweight program that handles the communication between the LLM and the MCP server(s).
- Optionally has functionality to display to the user the tools that are available through the MCP server(s).
To take the analogy of a restaurant, the LLM is your waiter who takes your request and creates an order. The lightweight program is the iPad the waiter uses to send your order to the kitchen (the MCP server). And sometimes the waiter comes with the menu to tell you which dish is available.
MCP server
- Responsible for completing requests from the MCP client and sending them back to the MCP client.
- Can connect to local resources or remote resources to fetch information or execute code.
- Responsible for communicating with the MCP client about which functionality is available.
Going back to the restaurant analogy, the MCP server is the kitchen that takes in the order from the waiter (the MCP client) and sends back the food. The kitchen is also responsible for telling the waiter beforehand which dish is on the menu. Optionally, the kitchen can update the waiter about which dishes are out or newly available.
The security risks of adopting MCP
Most of the security risks with MCP come from the MCP server. This is because it’s the MCP server that actually performs operations, whereas the MCP client merely calls the LLMs and handles the communication. For companies looking to use MCP servers or to build and offer MCP servers to their customers, there are different sets of considerations for each use case.
Security considerations for MCP server adopters
When you’re using MCP servers, it’s crucial to verify and vet MCP servers that come from a trusted source. Treat an MCP server like a piece of software you install on your computer, because a malicious MCP server can do as much damage as malware. Here are a few ways to find trustable MCP servers.
Use MCP servers from trusted providers
Some SaaS companies provide their users with official MCP servers. Examples include:
There are also registries that list official integrations, such as the official Model Context Protocol GitHub repository(opens in a new tab).
Verify open sourced MCP servers
One drawback with official first-party supported MCP servers is that most of them are MCP servers exposing the API of the first-party services. For example, the GitHub MCP server(opens in a new tab) allows an LLM to take actions similar to those that can be achieved via the GitHub API. However, if you’re interested in “utilities” — such as file system(opens in a new tab) or internet access(opens in a new tab) — you’ll have to look to open source projects. To make sure open source MCP servers are suitable for enterprise use cases, we recommend:
- Looking for projects that are maintained by reputable teams and have strong community engagement.
- Reading through the source code to make sure the MCP server is secure and up to date with security best practices.
- Once you’re confident in an MCP server, forking the repository and using your own instance to protect against malicious patches in the future.
Security considerations for MCP server developers
If you’re instead interested in creating MCP servers to offer to your customers, here are a few considerations to create a secure MCP server.
Limit the scope of the MCP tools
Given how powerful LLMs are, you might be tempted to give the AI even more controls over the MCP tools. However, we recommend avoiding these types of tools in your MCP servers:
- Arbitrary execution tools — While it’s really tempting to make MCP tools that allow LLMs to execute generated Python code, run generated queries on an SQL database, or run generated terminal commands, these MCP tools are especially vulnerable to remote code execution (RCE) attacks, either via LLM jail breaking or directly accessing the MCP server(opens in a new tab).
With careful tool design, you can still provide these functionalities without compromising on security. This might mean providing sandboxing for code execution, sanitizing tool input, or requesting user verification(opens in a new tab).
- Sensitive tools — Unlike the tools above, sensitive tools are working “as intended” while doing dangerous actions. This is a concern for development teams who automate their MCP creation process via tools that take an API specification and generate an MCP server. If your API contains sensitive endpoints such as creating/deleting credentials or dangerous endpoints such as deleting databases, extra care and attention must be taken to ensure the LLMs don’t accidentally leak or delete your customer data.
While not supported by most MCP clients like Claude Desktop, the MCP server can leverage the elicitation(opens in a new tab) feature to get the user’s confirmation before executing sensitive tools.
Prefer Standard IO over Streamable HTTP when possible
The MCP protocol supports two methods of transporting messages between client and server: Standard IO (stdio) and Streamable HTTP. Unless your use case requires using Streamable HTTP transport, such as creating a remote MCP server or managing multiple sessions, it’s recommended to run your MCP server using the stdio transport to reduce the risk of network attacks(opens in a new tab).
Keep up to date with MCP security documentation
And most importantly, MCP developers should keep up to date on the most recent security considerations from the official MCP documentation(opens in a new tab). This page contains vulnerabilities and mitigation strategies that are not discussed in this article such as DNS rebinding attacks and session hijacking.
How Nutrient adopts MCP
At Nutrient, we’re adopting MCP in the solutions we offer to customers, our open source contributions, and our internal tooling. Here are a few highlights:
- We offer MCP servers for our Document Web Service (DWS) Processor API and Document Engine, providing powerful PDF processing capabilities for AI agents.
- We open sourced the PDF MCP Server(opens in a new tab), which supports PDF document analysis and exploration to be used internally by our PDF engineering team.
Take advantage of our open source MCP server to explore and analyze PDF structures efficiently.
