Contact us Contact us Loading...
AI Security Engineering / Pillar
Assess, harden, and monitor the Model Context Protocol servers that connect Claude, Cursor, and GitHub Copilot to your systems. The attack surface is new. The methodology is not obvious. CyberTeam has published it.
Definition. MCP server security is the practice of assessing, hardening, and monitoring Model Context Protocol servers so AI agents cannot be manipulated by malicious tools, poisoned metadata, or attacker-controlled outputs. It is now a mandatory control for any organisation whose consultants or engineers use Claude, Cursor, or GitHub Copilot with tool integrations.
The Model Context Protocol (MCP), introduced by Anthropic in November 2024, has over 177,000 registered tools and roughly 97 million monthly SDK downloads (MCPShield, arXiv 2604.05969). It is now the de facto standard for connecting AI agents to external tools and data. It is also a new, mostly ungoverned attack surface.
Peer-reviewed research (arXiv 2603.22489) identifies 57 threat classes across the MCP ecosystem using STRIDE and DREAD frameworks. Tool poisoning — malicious instructions embedded in a tool's description or inputSchema — is the most prevalent client-side vulnerability. Analysis of seven major MCP clients revealed insufficient static validation in most implementations.
CyberTeam runs MCP server security assessments against a 15-control checklist covering trust boundary, authentication, tool integrity, authorisation, observability, and supply chain. Every finding maps to a specific control and a specific mitigation.
Scope
A full assessment covers every MCP server your organisation runs or consumes:
Each server is assessed for tool poisoning, indirect prompt injection, rug pull, token passthrough, excessive permissions, session hijacking, supply-chain compromise, and cross-server data leakage.
Method
Every engagement follows the same six-step methodology:
Deliverable
The deliverable is a report your internal audit team can defend, containing:
CyberTeam also publishes a 15-control MCP checklist if you want to self-assess before engaging us.
Yes. Both Claude Desktop and Cursor come with built-in MCP capabilities and can be extended with third-party MCP servers. If any consultant on your team has installed a community MCP server, you have an unassessed attack surface. Discovery of shadow MCP servers is part of every CyberTeam engagement.
A focused assessment of 3-5 MCP servers takes 3-5 working days. A comprehensive assessment of an organisation-wide AI agent deployment with 20+ servers takes 3-4 weeks. Both include the executive summary and remediation roadmap.
Yes. CyberTeam's AI Security Engineering practice implements the controls in the remediation roadmap, including hash-bound approval flows, attestation chains, and consent enforcement. We do not hand off to a third party for implementation.
MCP server security is not explicitly named in Essential Eight or NZISM as of 2026. However, the controls map cleanly onto Essential Eight's Application Control and Restrict Administrative Privileges, and to NZISM sections on supply chain security and authentication. CyberTeam provides the mapping as part of the deliverable.
If any consultant or developer in your organisation uses Claude, Cursor, or GitHub Copilot with tool integrations, MCP servers are already in play — the question is whether they are governed. A pre-deployment assessment costs less than a post-incident review.
A 30-minute scoping call gives you a clear view of your MCP attack surface and a fixed-price proposal for a full assessment. No obligation beyond the call.
Talk to Tom