What is an MCP Server and Why It's Fundamental for AI Agent Security

An MCP (Model Context Protocol) server is the instrumentation layer that allows an AI agent to interact with external systems. Hosted remotely, it functions as an API endpoint and requires anti-bot controls and WAF (Web Application Firewall), API security on its endpoints, and AI guardrails that inspect what tools send, not just what the user types.

The Importance of Tools for AI Agents

With the integration of artificial intelligence into every aspect of our lives, it has become clear that large language models have an isolated context, limited to training data and user inputs. To expand this knowledge, it is necessary to provide AI agents with appropriate tools to retrieve information, such as curl tools to view web pages, directory listing tools to retrieve files from a folder, or git CLI tools to commit changes to a repository.

What is an MCP Server?

An MCP server is a standardized service that exposes a defined set of tools, resources, and prompts to an AI agent via the Model Context Protocol, allowing the agent to act on an external system without custom linking code for each API. Developed by Anthropic, the Model Context Protocol was released as an open-source standard to connect AI applications to external systems. Published in November 2024 and contributed to the Linux Foundation's Agentic AI Foundation in December 2025, with over 10,000 MCP servers published.

Use Cases for MCP Servers

The use cases for MCP servers are numerous and continually expanding. They can enable AI agents to perform tasks such as searching for and booking flights, reviewing stock prices, and executing trading operations (this is not financial advice). MCP servers provide AI agents with the tools needed to do much more than just be an informative chatbot.

Security Risks of MCP Servers

All this functionality exposes an obvious security blind spot. Who protects the MCP server, which now has exposed tools to perform any of these tasks? Who governs what can be requested of your AI agent that now has access to these tools? The security implications are enormous.

This is not theoretical. Imperva's Threat Research Team documented a severe remote code execution vulnerability (CVE-2025-53967) in the Framelink Figma MCP server, an open-source project with over 10,000 stars on GitHub. OWASP's Gen AI Security Project published a practical guide for secure MCP server development in February 2026.

Local vs. Remote MCP Servers: Two Different Risk Profiles

Not all MCP servers present the same level of exposure. Many of them run locally, a process on your laptop that communicates with your agent via stdio, never touching a network. The risk is real, but it's a different conversation: credentials present in a configuration file and how much the server is authorized to reach on your behalf. However, when an MCP server becomes remote, hosted on HTTP and served to agents on the Internet, it stops being a local utility and becomes what it has always been in reality: an API endpoint. Exposed, authenticated, and ready to be probed.

Security Solutions for MCP Servers

Thales Imperva has focused on this aspect for several months. With decades of experience in securing websites and applications, Thales Imperva has adapted its solutions to cover these use cases and the complex threat landscape.

Automated traffic is the baseline here, not the exception. The Imperva 2026 Bad Bot Report found that bots represented over 53% of all web traffic in 2025, with 27% of bot attacks targeting API endpoints. A remote MCP server is an API endpoint, so it inherits this traffic profile as soon as it goes live. Knowing which AI bots to allow and which to block is the first control, not the last.

Thales Imperva's Cloud WAF and Advanced Bot Protection provide visibility into automated traffic directed toward the MCP server, preventing generically harmful bot traffic and more exploitative OWASP Top 10 attack classes such as command injection and SQL injection.

Thales Imperva's API Security protects the MCP server's endpoints from malicious requests, ensuring that only authorized and validated traffic reaches the tools.

Thales Imperva's Runtime Application Self-Protection (RASP) provides real-time monitoring and protection for the MCP server, detecting and blocking suspicious activities before they can cause damage.

The Economic Impact of MCP Server Breaches

A recent study revealed that companies experiencing breaches of their MCP servers see an average 15% drop in user trust, with direct costs that can exceed €500,000 per incident.

The most affected industries include the financial sector, where MCP servers handle sensitive transactions, and e-commerce platforms, where breaches can lead to significant losses of personal data.

The Future of Secure MCP Server Development

Experts predict that in the coming years, we will see a significant increase in secure development tools specifically designed for MCP servers.

In particular, we expect:

• Widespread adoption of automated security testing frameworks for MCP tools
• Development of shared standards for MCP server security certification
• Integration of security controls into the software development lifecycle (SDLC) for MCP servers

Case Study: Secure Implementation of an MCP Server for a Logistics Company

A leading logistics company recently implemented an MCP server to optimize supply chain management.

The solution included:

• Integration with the existing warehouse management system
• Implementation of multi-factor authentication controls
• Configuration of context-based security policies
• Continuous monitoring via a dedicated SIEM system

The results showed a 30% reduction in order processing times and a significant improvement in the ability to detect and block suspicious activities.

Resources to Deepen Your Understanding of MCP Server Security

For those who want to delve deeper into the topic, we recommend consulting:

• The official document on Model Context Protocol security best practices
• The Practical Guide for Secure MCP Server Development published by OWASP
• The 2026 Bad Bot Report by Imperva