MCP: The Authorization Flaw Threatening AI Integrations

An Authorization Problem Revealed by a Personal Experience

A backend engineer working at a fintech startup recently shared a revealing experience regarding the integration of the Model Context Protocol (MCP) into their infrastructure. After deploying an AI agent designed to interact with various internal tools such as a CRM, a billing system, and Slack, an anomaly was detected during a security audit. The AI agent still had full read/write access to a tool it hadn't used for three weeks. This access had never been revoked, as the system did not provide a mechanism to do so. Although this did not result in data theft, it highlighted a structural weakness that appears in almost all currently deployed MCP integrations: permission management is often overlooked. A friend of the author even sent an alarming message starting with "so this is bad," emphasizing the urgency of the situation. This issue was not a bug in the AI agent's code, but a structural flaw in the very design of authorization, often considered an afterthought.

Understanding the MCP: An Expanding Standard

The Model Context Protocol (MCP) is a standard that facilitates communication between AI models and various tools or external data sources. It allows AI agents to connect to databases, APIs, and SaaS platforms through a common interface, providing everyone with a shared language. This standardization is comparable to USB-C, which has unified connectors for electronic devices. The MCP aims to do for AI agents what USB-C has done for electronic devices, simplifying connections. However, just as USB-C does not ask for permission before starting to transfer data, the MCP presents a similar weakness by often neglecting permission management. Thanks to this simplicity, the MCP has quickly gained popularity, as it saves development teams from reinventing the wheel for each new AI agent. However, this ease of integration comes with a lack of rigor in permission management, an aspect often underestimated. This is the conversation that no one has yet sufficiently addressed.

Specific Flaws of the MCP

The main issue with the MCP lies in the authorization layer between the AI agent and the tools it accesses. Three major problems are often encountered:

• Overly General Consent Screens: When connecting an MCP server to an agent, users are often faced with a simple consent screen, granting global access to a tool without detailing specific permissions, such as reading calendars or sending emails. This approach recalls the early days of mobile applications before granular permissions were introduced by Android and iOS.

• Persistent Access Tokens: Once an AI agent obtains a token to access a tool, this token remains active well beyond the necessary period, as illustrated by the example of the billing system. The lack of mechanisms to verify and revoke these tokens leads to prolonged unwanted access.

• Uncontrolled Delegation: Theoretically, an AI agent should only act within the permissions explicitly granted. However, in practice, tokens are often passed to other tools or agents without revalidation, inadvertently broadening the originally intended scope.

These combined issues create a pattern where AI agents have more access than intended, for a longer duration, and with less oversight. Teams often copy and paste the same lightweight authentication model across all connections, thereby amplifying the risks.

A Very Real Risk

It would be easy to consider these problems as isolated cases, but the rapid adoption of AI agents in businesses shows otherwise. Organizations are quickly moving from a handful of pilot agents to dozens of task-specific agents integrated into real systems like CRMs and HR platforms. Each connection represents a new OAuth-style handshake, and most teams copy and paste the same lightweight authentication model across all these connections, as this is what the MCP has made easy. This phenomenon is repeating on a large scale, much faster than security processes can adapt.

Concrete scenarios illustrate these risks:

• The Forgotten Integration: A marketing team uses an agent for a specific campaign, but the access token remains active long after the campaign ends, without anyone noticing.

• The Chained Agent: An agent with access to a support system delegates a task to another agent, which ends up having broader access than necessary.

• The Risk of Departing Employees: An employee leaves the company, but the agent they configured continues to operate with the same access, as departure procedures do not yet cover AI agent permissions.

These situations do not require sophisticated attacks but simply result from insufficient organizational management.

Current Solutions and Their Limitations

Teams are adopting various strategies to manage these issues, each with its own trade-offs.

• Trust in the Platform: Some teams rely on the default authentication flow provided by their MCP server. This method is quick to implement but inherits all the weaknesses mentioned. It may be suitable for prototypes but is risky in production.

• Manual Scope Management: Some teams choose to manually define access scopes for each agent. This offers more control but requires constant monitoring and can become complex to manage at scale.

In conclusion, while the MCP offers an elegant solution for integrating AI agents, it is crucial for companies to revisit their permission management practices to avoid potential security vulnerabilities.