Your agent's tool surface is your attack surface

MCP lets your AI agent call tools. It can read files, query databases and hit APIs. That is the point of it.

The part most teams skip is who decides. The agent picks which tools to call, and with what arguments, based on context it assembled from sources you may not control: what the user typed, what a retrieved document said, what an earlier turn left behind.

A tool is an endpoint with a model in front of it

Take an MCP server that exposes a tool called execute_query, where the model can pass arbitrary SQL. That isn’t a tool integration. It’s a SQL injection vulnerability with an LLM as the intermediary.

The usual defence against injection is to keep untrusted input away from the query. Here, the untrusted input is the context the model reads, and the model writes the query. A firewall rule or a web form validator doesn’t sit anywhere on that path.

The trust boundary question

The test is one question. Can the model be influenced, by a user, by retrieved content or by a prior conversation turn, to call a tool in a way you did not intend?

If the answer is yes, and for most agents it is, that tool’s permissions need the same scrutiny you would give a public API endpoint. Assume someone you don’t trust can reach it, because in effect they can.

What is usually missing

Three controls are absent from most agent deployments I look at.

Per-tool authorization scoping. The agent gets access to the tools a task needs, not blanket access to every registered tool. A summarizer doesn’t need a shell.

Input validation on tool arguments, before execution. Check the arguments against what the tool should accept before it runs. Checking afterwards is incident response.

Audit logging of every tool invocation. Log the call, the arguments and the full context that produced it. Without the context, the log says what happened but not why, and “why” is the question every review asks.

None of these is new. They are the controls you already apply to an API. The agent just moved the caller.

Your agent’s tool surface is your attack surface. Treat it accordingly. If you want someone to test it the way an attacker would, book a scoping call.